Contents
|
|
|
|
Additional Information
|
Financial Statements
2019 ING Group Annual Report on Form 20-F
23
computer virus or a failure to anticipate or prevent
cyber attacks or other attempts to gain
unauthorised access to digital systems for purposes of misappropriating assets or sensitive
information, corrupting data, or impairing operational performance, or security breaches by third
parties), inadequate or failed internal control processes and systems, regulatory breaches,
human
errors, employee misconduct, including fraud, or from natural disasters or other external events
that interrupt normal business operations. Such losses may adversely affect our reputation,
business and results. We depend on the secure
processing, storage and transmission of
confidential and other information in
our computer systems and networks. The equipment and
software used in our computer systems and networks may not always be capable of processing,
storing or transmitting information as expected. Despite our business continuity plans and
procedures, certain of our computer systems and networks may have insufficient recovery
capabilities in the event of a malfunction or loss of data. As part of our Accelerated Think Forward
strategy, we are consistently managing and monitoring our IT risk profile globally. ING is subject to
increasing regulatory requirements
including EU General Data Protection Regulation (‘GDPR’) and
EU Payment Services Directive (‘PSD2’). Failure
to appropriately manage and monitor our IT risk
profile could affect
our ability to comply with these regulatory requirements, to securely
and
efficiently
serve our clients or to timely, completely or accurately process, store
and transmit
information, and may adversely impact our reputation, business and results. For further description
of the particular risks associated with cybercrime, see “–We are subject to increasing risks related
to cybercrime and compliance with cybersecurity regulation”
below.
Widespread outbreaks of communicable diseases may impact the health of our employees,
increasing absenteeism, or may cause a significant increase in the utilisation of health benefits
offered to our employees, either or both of which could adversely impact our business. We also
face physical risks, including as a direct result of climate change, such as extreme weather events
or rising water levels, which could have a material adverse effect on our operations, particularly
where our headquarters may be impacted.
In addition, other events including unforeseeable
and/or catastrophic
events can lead to an abrupt interruption of activities, and our operations may
be subject to losses resulting from such disruptions. Losses can result
from destruction or
impairment of property, financial assets,
trading positions, and the loss of key personnel. If our
business continuity plans are not able to be implemented, are not effective or do not sufficiently
take such events into account, losses may increase further.
We are
subject to increasing risks related
to cybercrime and compliance
with
cybersecurity regulation.
Like other financial
institutions and global companies, we are regularly the target
of cyber attacks.
In particular, threats from Distributed Denial of Service (‘DDoS’), targeted attacks (also called
Advanced Persistent Threats) and Ransomware
intensify worldwide, and attempts to gain
unauthorised access and the techniques used for such attacks are increasingly sophisticated. We
have faced, and expect to continue to face, an increasing number of cyber attacks (both successful
and unsuccessful) as we have further digitalized. This includes the continuing expansion of our
mobile- and other internet-based products and services, as well as our usage and reliance on cloud
technology. In 2019 we experienced continuous DDoS attacks, of which one DDoS attack breached
our DDoS defences (compared to two attacks in 2018). This DDoS attack caused an outage of
approximately four-hours, which affected customers of ING in Romania. In addition, ING Philippines
experienced one virus infection on a vendor-supplied server for two hours, which had no customer
impact. Furthermore, due to our reliance on national critical infrastructure and interconnectivity
with third-party vendors, exchanges, clearing houses, financial institutions
and other third parties,
we could be adversely impacted if any of them is subject to a successful cyber attack or other
information security event.
Cybersecurity, customer data and data privacy have become the subject of increasing legislative
and regulatory focus. The EU’s second Payment Services Directive (‘PSD2’), implemented in 2019,
and GDPR are examples of such regulations. In certain locations where ING is active, there
are
additional local regulatory requirements and legislation on top of EU regulations
that must be
followed for business conducted in that jurisdiction. Some of these legislations and regulations may
be conflicting
due to local regulatory interpretations. We
may become subject to new EU and local
legislation or regulation concerning cybersecurity, security of customer data in general or the
privacy of information we may store or maintain. Compliance with such new legislation or