After a year of prominent hackings of millions of US credit and debit cards, one of the top regulators regulators of the American financial system has said that the prospect of an “Armageddon-type cyber event” is one of the most significant issues he plans to address in the next year.

New York State Department of Financial Services chief Benjamin Lawsky presides over an agency that is three years old and has pushed for harsher fines and executive accountability for banks including Standard Chartered and BNP Paribas.

On Monday, Lawsky said the technological vulnerabilities of the financial system are a pressing and potentially catastrophic problem.

“I worry that we’re going to have some sort of major cyber event in the financial system that’s going to cause us all to shudder, an Armageddon-type cyber event,” Lawsky said at the Bloomberg Link Most Influential Summit.

Lawsky elaborated that it would be “something that causes a blip in the financial system for a period of time” and compared it to the attacks on the World Trade Center on 9/11.

“The failures to detect the 9/11 plot were sort of a failure of imagination, some would say …I worry about the same thing here: that an event will happen and we’ll all look back at it and say, ‘How did we not do more?’”
Lawsky said he and other regulators are considering “concrete actions” to encourage banks to be vigilant, including a cyber insurance fund that would help banks cover some liability if they step up their online security. There is a current private market for such insurance, but it is so small as to be negligible.

A spokesman said that the form of the incentives is still under discussion by regulators. He said the cost of tighter cybersecurity will cost a number of people: “Shareholders will have to bear it, customers will have to bear it, taxpayers are going to have to bear it.”

Over the past year, several prominent US companies saw hackers slip into their customers’ credit-card data. Target, Home Depot and JP Morgan all suffered significant data breaches.

In all cases, the attacks were not only massive in size, but also occurred over several months. In the case of Home Depot, the company said a five-month attack on its data systems compromised 56 million credit cards. The Target hacking compromised 40 million cards, and the attack on JP Morgan continued between June and August without the bank’s knowledge.

Lawsky suggested the attacks will only get more prevalent and harder to capture.

“Cybersecurity experts will tell you when they get in a room with a bunch of CEOs to talk about this, there’s only two types of people they meet: people who have been hacked and know it and people who have been hacked and don’t know it.

“In other words, it’s that prevalent. The sophistication of the hackers is that great that they’re breaking into everything. And it thus feels to the really – to a lot of people like only a matter of time before we have something more systemic, more problematic, more coordinated.”

Lawsky also discussed his thinking around fines on RBS, Standard Chartered and BNP Paribas, stressing that he believed that holding “a few bad apples” accountable was key to his method.

“I think if you’re not holding individuals accountable, you’re not going to get the full effects of deterrence,” he said.

Banks, he said, often “jump at this” individual approach as a way to punish wrongdoing that might otherwise wrap up the entire firm.

“They’ll say if you’ve identified, Mr Regulator, individuals who did this, that and the other thing which was clearly wrong, just exposing it to the light of day has a salutary effect often,” Lawsky suggested.

On the RBS case, he said: “I think we realized that just damning the entire firm is actually often counterproductive. It puts you in a position of saying or making it look like the whole firm is to blame.”

“And often, by the way,” Lawsky added, “a huge fine is picked up by shareholders or customers or whoever the costs are passed along.”

Lawsky also explained his decision to go after Standard Chartered a second time, after installing a monitor inside the bank after its first $667m fine for helping alleged money-laundering.

“Regulators get a bigger settlement, pound their chest, move on to to the next case and the monitor is left inside the bank,” Lawsky said. “They’re being paid by the bank. They’re spending all their time with very nice people in the firm, and all too often we see the results of those monitorships is sort of less than satisfying.”