Technology service provider user list (restricted access)

Confidential single-source data: not exercised here

This is a confidential list of bank-vendor relationships. It is not for sale and not publicly downloadable: it carries no provenance badge because there is no access path we can run here. Identifying which banks used a particular third-party technology service provider (TSP) is sensitive supervisory/operational information, obtained under a confidential arrangement. The page documents what the data is and the gotchas; treat it as unverified. This is the honest grade under the institute’s Verified discipline.

The TSP user list identifies which banks were customers of a specific third-party technology service provider that suffered a cyberattack. By itself it is a small but pivotal dataset: it is the treatment indicator that separates banks that lost access to the provider’s services from those that did not, which is what makes a clean event study of cyber propagation possible. A paper we distill uses it: Kotidis & Schreft use the confidential user list as the treatment-group indicator (user versus nonuser banks) when tracing how a cyberattack propagates through the Fedwire payment system.

• Cost: not for sale. Confidential single-source data.
• Source: confidential records of which banks used the attacked TSP (a vendor-relationship mapping, not a market product).
• Coverage: the set of banks linked to one technology service provider around the attack event; it is an identification key, not a broad panel.

Access (restricted)

• No public download and no resale. Vendor-relationship identities are sensitive and are not published; the list was obtained under a confidential arrangement.
• Event-specific and supervisory in nature. The list pertains to one provider and one episode; it is paired with confidential payment data inside a secure environment. There is no standing way for a third party to reach it.

Gotchas (the ones that bite pipelines)

These are the failure modes to expect; they are documented, not verified here.

• It is a treatment indicator, not an outcome. The list only says who used the TSP; all the economics comes from pairing it with payment and borrowing data. Without the linked outcomes it carries no information on its own.
• TSP use is not random. Banks chose this provider for reasons (size, region, business model) that may correlate with outcomes; the user/nonuser split is not a clean experiment by itself. The design must address selection.
• Membership can be fuzzy at the edges. Some banks use a provider partially, or through an intermediary; binary user/nonuser coding hides partial exposure. Check how borderline relationships are classified.
• Identifier joins. Banks on the list must be linked to Fedwire participants and to Call Reports (RSSD) for outcomes and controls; mergers break the link. Verify the crosswalk.
• Not redistributable, and the provider is not named. The vendor and the bank identities are confidential; results are reported in aggregate. Plan for non-reproducibility of the raw inputs.

Citation

Cite the source and arrangement, e.g.: Confidential user list for the attacked technology service provider; used under arrangement, YYYY-MM-DD. State the event, the user/nonuser coding, and the data it was linked to.