Wall Street's digital lifelines: How severed undersea cables could be a big problem for the global financial system

• There have been a series of mysterious incidents of severed undersea cables.
• Damage to undersea cables could negatively impact the global financial ecosystem.
• Security and policy experts say what it could mean for finance firms and how to mitigate the risk.

While much of banking and trading seems to have gone digital, the global financial system still depends on a vast network of undersea cables that crisscross the sea floor. Carrying $10 trillion worth of transactions every day and powering Wall Street’s global trading and communications, these cables have had little mainstream attention as they lay deep in the world’s oceans for decades quietly serving their purpose.

But now these cables, many no thicker than a garden hose, are at the center of a series of mysterious incidents that have Wall Street security leaders and consultants on high alert.

Tankers dragging their anchors have severed undersea cables in recent months in the Baltic Sea and East China Sea. Officials in Europe accuse Russia of sabotaging the infrastructure, while Taiwan has said it suspects China is behind the damage off of its northern shores. The cables are part of a network spanning about 745,000 miles that transmits 95% of the world’s data. The snap of a few subsea cables has knocked islands the size of Taiwan offline, cutting off access to communications, internet, and banking.

For financial institutions the potential impact of damaged cables is far-reaching, especially as the economy has become more global, according to Valerie Abend, Accenture’s global financial services cybersecurity lead.

Central banks, large commercial and investment banks, and massive payment companies rely on these cables for transnational payments, foreign currency exchanges, and credit-card processing. Hedge funds and investment firms depend on these rails for the clearing and settling of their trades, and the corresponding pricing and volume data they use to decide what to buy and sell. Even newer technologies, like the public cloud, rely on these undersea cables to balance the compute loads across data centers.

“Concerns are not isolated to any specific type of financial firm. The entire financial sector can be impacted by subsea cable disruptions,” Cameron Dicker, director of global business resilience at Financial Services Information Sharing and Analysis Center (FS-ISAC), told Business Insider.

The string of events, set against rising geopolitical tensions and the suspicion of nefarious intentions, has cybersecurity leaders concerned about the vulnerability of this critical infrastructure that underpins much of the modern banking ecosystem. Despite it being a weak spot, the financial ecosystem is so intertwined with these cables that experts say the public and private sectors will need to work with the infrastructure they’ve got. But repairing and replacing the cables is expensive and time-consuming. And for many of those information security leaders on Wall Street, it’s just another notch in a long string of threats they need to defend against.

Time-consuming, costly, and a limited number of skilled workers

The FS-ISAC, which is a nonprofit that focuses on the resilience of financial infrastructure, identified the risks related to subsea cables as a key area of focus in 2024, according to Dicker, who’s worked at the US Department of Treasury and Federal Reserve in incident management and response roles. The nonprofit published a report in December about the threat of subsea-cable disruptions, which shows “that this is something that financial services have not lost their eye on as a potential particularly interesting area of risk for them,” said Accenture’s Abend.

“There’s just a growing area of interest of, ‘What we do do? The world all depends upon this,'” Abend said.

The private and public sectors have a few options to mitigate the risk of severed subsea cables, which are typically owned and operated by private infrastructure providers, big telecoms, or tech companies like Google and Meta.

Related stories

Redundancy in the number of cables is key. There were about 530 subsea cables as of September 2024, according to a recent report from FS-ISAC. That said, about 100 to 150 of those cables are damaged each year. Repairing cables is a dangerous job that has a limited number of companies with the necessary equipment and a dwindling number of workers with the right skillset and experience.

Not to mention, it is a time-consuming task — in 2023, it took an average of 40 days to repair a cable, according to FS-ISAC’s report. Laying new cables is costly, running roughly $30,000 to $50,000 per kilometer of cable, according to the Center for Strategic and International Studies.

Coming up with new ways to monitor, and ideally prevent, damage is a promising way to mitigate risk, Abend said. In January, NATO said it was deploying ships, aircrafts, submarine satellites, and naval drones to surveil and defend cables in the Baltic Sea.

Abend said the critical public- and private-industries — like banking, telecommunications, and the government — that leverage these cables should work together to agree on a sort of prioritization schedule to make sure the most critical traffic and transactions are rerouted first to alternative cables.

‘Life in the big city’

While the incidents in the last 18 months have brought the risk of disrupted subsea cables to the forefront, it doesn’t necessarily reflect the increased risk to the financial sector, FS-ISAC’s Dicker said. He said the world hosts sufficient subsea cables to allow data and money to flow through alternative paths.

There’s no doubt that systemically important financial institutions with $10 billion-plus tech budgets, that are subject to massive amounts of regulatory scrutiny, are spending a lot of time on this issue, James Kaplan, McKinsey partner technology-practice leader, told BI. But smaller, niche institutions with less regulatory oversight and limited ability to disrupt the US financial system, have fewer resources to be able to worry about this, he said.

If Kaplan were to ask chief information security officers or chief technology officers about this, “I think they would say, ‘this is life in the big city. Yes, this is something I have to worry about. Is this at the top of my list? No,'” he said.

What would more likely be at the top of that list are the fast-moving regulatory environment, third- and fourth-party risk, phishing emails, or securing AI-generated code, he said.

“Broadly, there’s a long list and I would say this is somewhere on the list, but not at the top of that list,” Kaplan said.