Can a cyber attack take down a bank? What has actually happened

MacWindowsiPhoneAndroidUpdated

It's one of the risks UK financial firms cite most. In a Bank of England survey published on 30 September 2026, firms named geopolitical risk and cyber attack as the two most frequently cited sources of risk. But the major UK bank outages that the FCA and the Treasury Committee have described were put down to IT failures, and Google attributed the 20 October 2026 Google Cloud outage to a power event.

Quick answer

A cyber attack can make systems unavailable, and UK regulators require banks to plan for that kind of disruption. The large UK banking outages described by regulators and Parliament, such as TSB in 2018 and the Barclays outage in early 2025, were blamed on technical failures. Google attributed the 20 October 2026 outage to an external power disruption.

How could a cyber attack disrupt a bank?

The UK's National Cyber Security Centre (NCSC) describes two kinds of attack that can knock services offline.

  • Denial of service: the NCSC defines this as "an attempt to overload a website or network", aiming to degrade its performance or make it completely inaccessible. It says a successful attack typically results in loss of availability of part, or all, of a system.
  • Ransomware: the NCSC calls this malware that prevents you from accessing your computer or its data. It says ransomware attacks "can be devastating for organisations because computer systems are no longer available to use", and some data may never be recovered.

Finance is a target. The NCSC's Annual Review 2025 lists finance among the top sectors reporting ransomware activity to it, alongside academia, engineering, retail, health and manufacturing.

How common are serious cyber attacks in the UK?

The NCSC's Annual Review 2025 covers 1 September 2024 to 31 August 2025. In that year, its incident management team handled 429 incidents. Of those, 204 were nationally significant, 48% of the total, and 18 were categorised as highly significant.

The review doesn't name individual banks among those incidents. The Bank of England's Systemic Risk Survey for the second half of 2026, carried out between 27 July and 24 August 2026 among 57 firms, says cyber attack is considered among the most likely risks to materialise and among the most challenging to manage.

What caused the big UK bank outages?

The ones described by regulators and Parliament were technical failures.

  • TSB, April 2018: TSB moved its customer data to a new IT platform, and the platform began failing straight away. The Financial Conduct Authority (FCA) said a significant proportion of TSB's 5.2 million customers were affected. On 20 December 2022 the FCA and the Prudential Regulation Authority (PRA) fined TSB a total of £48.65m for operational risk management and governance failures relating to its IT upgrade programme, and said TSB had paid £32.7m in redress.
  • Nine banks and building societies, January 2023 to February 2025: the House of Commons Treasury Committee published data on 6 March 2025 showing at least 158 IT failure incidents, adding up to at least 803 hours of unplanned outages, more than 33 days. The common reasons the banks gave were problems with third-party suppliers, disruption caused by a change in systems, and internal software malfunctions.
  • Barclays, 31 January to 2 February 2025: the Treasury Committee said Barclays confirmed 56% of online payments during the incident failed because of "severe degradation" of its mainframe processing performance, and that it expected to pay between £5m and £7.5m in compensation.
  • CrowdStrike, 19 July 2024: the FCA said a CrowdStrike content update for Windows had "a defect that caused systems to crash", with varying degrees of impact on regulated firms. The NCSC said the outages were "not the result of a security incident or malicious cyber activity".

None of the official sources in this guide records a UK bank's services being taken down by a cyber attack.

Was the 20 October 2026 Google outage a cyber attack?

Google attributed it to a power event in zone europe-west2-b of its London region. Its final incident report of 27 October 2026 traces it to an underground cable fault outside the data centre and a misconfiguration in the generator controls, and does not describe a cyber attack.

We go through the evidence in was the Google outage a cyber attack, and the timeline in our guide to the 20 October Google Cloud outage.

What do regulators require banks to do?

Plan to keep running through disruption, whatever causes it. The FCA defines operational resilience as the ability of firms and the financial sector to prevent, adapt and respond to operational disruption, and to recover and learn from it.

  • Important business services: under rules in force since 31 March 2022, firms identify the services that would cause intolerable harm if disrupted, and set an impact tolerance, the most disruption they can tolerate. The FCA says firms had until 31 March 2025 to make sure they could stay within those tolerances. The PRA sets out its expectations in supervisory statement SS1/21.
  • Testing against attackers: the FCA describes CBEST, a form of live penetration testing that "mimics the actions of cyber attackers", as one of its tools for assessing firms' cyber resilience.
  • Cloud providers: on 10 July 2026, HM Treasury said four technology providers would be designated as critical third parties from 13 July 2026: Google Cloud EMEA Limited, Amazon Web Services EMEA SARL, Microsoft Ireland Operations Limited and Oracle Corporation UK Limited. It said the Bank of England, PRA and FCA will jointly oversee the critical services they provide to the financial sector.

What can I do when my bank goes down?

Keep a second way to pay, and be wary of messages about the outage. Our guides cover how to pay when your banking app isn't working and scam texts after a bank outage.

More questions

Has a cyber attack ever taken down a UK bank?

None of the official sources in this guide records one. The major UK outages that the FCA, PRA and the Treasury Committee have described, including TSB in 2018 and Barclays in 2025, were put down to IT and system failures. The NCSC does list finance among the sectors reporting the most ransomware.

What is a critical third party?

A technology or service provider whose services underpin the UK financial system, designated by HM Treasury. The Treasury says that under the regime, which applies from 13 July 2026, the regulators will be able to gather information, assess resilience and work with these providers on risks, including by making and enforcing rules for them where necessary.

What is CBEST?

CBEST is a testing approach the FCA uses to assess firms' cyber resilience. The FCA says it uses live penetration testing that mimics the actions of cyber attackers.

Why do banking apps go down if it isn't an attack?

The common reasons given by the banks that wrote to the Treasury Committee in February 2025 include problems with third-party suppliers, disruption caused by a change in systems, and internal software malfunctions.

How do I tell an outage from an attack?

Wait for the company's own explanation, or the NCSC's. For the CrowdStrike outage in 2024, the NCSC said on the same day that it was not malicious. For the 20 October 2026 outage, Google's status page named a power event within hours.

Sources