FICOBA
A national bank-account file reached through a compromised high-trust credential — one official's login, with access granted for information exchange between ministries. (Source: DGFiP statement)
The Privileged Access Blind Spot: Financial Services
In finance, the breach almost never starts with the core banking system. It starts with a credential that could reach it: a vendor's, a contractor's, or an employee's that outlived the job. The three incidents below share that shape.
Two pagesPublic reporting onlyFreeWritten by certified engineers
The incidents
Three breaches, one pattern
Santander
Customer and staff data accessed in a database hosted by a third-party provider. (Source: Santander statement)
Standing access
The common failure: over-permissioned roles and access that never expires, so one compromised credential becomes a systemic problem rather than a contained one.
The read-across
What the pattern means for you
Your core systems are examined constantly. The access paths into them are not. The question is not whether your mainframe is hardened; it is who can reach it from outside, through what, and whether anyone would notice at 2am.
Self-check
The 60-second self-check
- Can you list every third party with privileged access to a financial reporting system, today, without asking anyone?
- Do vendor sessions into core systems go through a broker that records them, or through VPN and a shared credential?
- When a contractor's engagement ends, how many hours until their access is gone — and who checks?
- Could you produce the last completed access review for your payments platform in under ten minutes?
- Is there a privileged account on your mainframe that nobody currently employed created?
If any answer is "no" or "I would have to ask", that is the blind spot.
The full brief
Get the full brief
The two-page PDF adds the full account of each incident and the control that would have stopped it. Name and work email, and it comes straight back.
Next
Where to go next
The sector page: identity security for financial services. The service that closes the gap: PAM implementation. And a free audit is 30 minutes with a certified engineer on your own environment, findings in writing: Get a free audit.
Get the Financial Services brief
Name and work email. The two-page PDF covers each incident in full and the control that would have stopped it.