Devastating attacks at M&S, the Co-op and Harrods highlight risks as lenders say cybersecurity is biggest expense

It is every bank boss’s worst nightmare: a panicked phone call informs them a cyber-attack has crippled the IT system, rapidly unleashing chaos across the entire UK financial industry.

As household names in other industries, including Marks & Spencer, grapple with the fallout from such hacks, banking executives will be acutely aware that, for them, the stakes are even higher.

Within hours of a successful bank hack, millions of direct debits could fail, leaving rents, mortgages and wages unpaid. Online banking may be blocked, cash machine withdrawals denied, and commuters left in limbo as buses and petrol stations reject payments. News of the attack could spark panic, leading to a run on rival lenders, as customers pull money from their accounts amid fear the disruption could spread.

This situation may seem far-fetched but it is not a long way off from the government’s “reasonable worst-case scenario” if a sophisticated cyber-attack hit a big UK bank. With the financial industry among 14 sectors categorised as “critical national infrastructure”, it is no surprise that a hack is listed on the national risk register, which models some of the biggest threats facing the UK.