PHP security alert: banks take protective measures to safeguard clients

The alert affects organisations worldwide, across many sectors. It is not limited to Luxembourg or to banking. The vulnerabilities could allow attackers to gain unauthorised access to affected servers. Security updates were released on 21 October.

In Luxembourg, the competent authorities and cybersecurity teams, including the CIRCL and the CSSF, promptly issued alerts and recommendations. The ABBL also relayed these to its members, helping banks respond quickly and take appropriate protective measures.

Why some services may be temporarily unavailable

Temporarily restricting access to a website or online service can help prevent attackers from exploiting a vulnerability while technical teams secure the systems.

An unavailable banking website does not, in itself, mean that money or data has been stolen. A temporary closure can be a precaution, allowing teams to assess potential impacts, apply security updates and carry out checks. Banks coordinate this work with their service providers and, where relevant, their international banking groups.

Banks must also report major IT incidents to their supervisory authority under the European Digital Operational Resilience Act (DORA). These reports are updated as investigations progress. Where a major incident affects clients’ financial interests, banks must inform those clients without undue delay.

How clients can access banking services

The availability of services may vary between banks. Clients whose mobile banking app remains available can continue to use it to check their accounts and make transfers. Wero also remains available for clients whose banks offer the service.

Clients can contact their usual adviser or customer service team for assistance with urgent transactions and information about alternative options. These may include paper transfer instructions, such as a TUP, submitted through channels accepted by their bank.

Clients should also remain alert to fraudulent messages. Cybercriminals may use the situation to send fake emails or text messages claiming to come from a bank. Clients should always use their bank’s official communication channels and never share passwords, PINs or authentication codes.

Stay alert to phishing attempts

Clients should be particularly vigilant during this period. Fraudsters may exploit concerns about service interruptions by sending emails or text messages, or making calls, pretending to represent a bank.

Do not click on links in unsolicited messages or disclose passwords, PINs or authentication codes. Be wary of anyone asking you to transfer money to a supposedly “safe account”. If in doubt, contact your bank using its usual contact details.

For practical advice on recognising fraud attempts and what to do if you have been targeted, visit cyberfraud.lu.