When a cyberattack undermines trust: can digital identity remain protected when systems fail?

A cyberattack can interrupt essential services within moments. But the lasting harm is not confined to downtime. What happens when attackers also compromise a person’s digital identity, an administrator’s permissions or the power to approve sensitive actions? Could a different identity architecture limit the damage?

On 15 October 2026, Slovenian news outlet 24ur.com highlighted a forthcoming professional discussion of cyber resilience in financial institutions, raising questions about incident preparedness, continuity and customer trust. The article was not a report of a newly confirmed breach at a particular bank. It provides a useful starting point for a broader examination of trust.

Institute 1 April extends that question to identity, authority and accountability. A running service is not proof that every access is legitimate; a successful sign-in is not proof that the rightful person approved a particular action.

Three distinct consequences of one incident

The first risk is service unavailability. A person may be unable to make a payment, access an insurance record or use a public portal. Recovery arrangements, backups, redundant infrastructure and business-continuity plans are essential here.

The second risk is loss of data confidentiality or integrity. Attackers may read, copy, change or delete records. Restoring an application does not prove that its data is trustworthy. Organisations need access controls, audit trails, integrity checks and independent ways to verify changes.

The third risk is compromised identity and authorisation. An attacker can misuse a logged-in session, an employee’s credentials or an administrative account. A system may treat the resulting actions as valid merely because the account is authenticated. Yet identity, entitlement and approval of a specific action are three different questions.

Trust is now a cybersecurity concern

Not every attack requires the intruder to break directly into a protected database. Sometimes a convincing forged message, an abused session or a false claim of authority is enough to persuade someone to take a dangerous step.

The European Union Agency for Cybersecurity, ENISA, analyses threats including ransomware, exploited vulnerabilities, supply-chain attacks and social engineering. Generative AI can make fraudulent communications more persuasive. The challenge therefore reaches beyond login security: who is allowed to do what, for which purpose and under whose independently verifiable approval?

DORA, NIS2 and operational resilience

The EU’s Digital Operational Resilience Act (DORA) has applied since 17 January 2025. It sets a framework for ICT risk management, major-incident reporting, resilience testing and managing risks arising from ICT third-party providers in the financial sector.

The NIS2 Directive strengthens cybersecurity risk-management requirements for a broader group of critical and important entities. Both frameworks help organisations prepare for incidents and limit disruption. However, regulatory compliance is not a guarantee that an account or a permission can never be abused.

Operational resilience also requires organisations to identify and contain an attack, resume services and determine whether records, identities and permissions remain reliable afterward.

What is the QEI research concept exploring?

Institute 1 April is developing research questions under QEI – Quantized Encrypted Identity. One direction asks whether some identity-related trust boundaries could remain independent of ordinary user and administrator accounts. The aim is not to replace network security, but to investigate additional safeguards for identity and certain high-risk operations.

Independent identity verification

A sensitive operation could require a cryptographically verifiable, action-bound proof rather than relying on a password or active login alone. The research objective is to disclose only the information necessary for the task.

Separating administrative authority

A system administrator needs tools to maintain infrastructure. That does not necessarily justify access to every person’s identity record or the ability to authorise actions in that person’s name. Separate keys, least privilege and independent approvals are therefore worth exploring.

Verifiable approval for a specific action

“The account is logged in” is different from “the authorised person approved precisely this transaction.” A proof could, in principle, be restricted to a defined operation, purpose and time window, and verified outside the administrator’s account.

Revocation and controlled recovery

When compromise is suspected, credentials and permissions should be revocable and recoverable through a controlled process. Recovery itself must not become another single point of abuse.

An example: a compromised administrator

Imagine an attacker gains access to a financial institution’s administrative account. The consequences depend on its privileges and the protections around it. Overly broad powers may allow changes to configurations, access to sensitive records or attempts to take over other accounts.

In an architecture that separates infrastructure administration from keys needed for sensitive identity actions, such access might not be sufficient for every subsequent abuse. Compromise of one account should not automatically compromise a person’s entire digital identity. Whether that separation holds under attack would need to be demonstrated experimentally.

We explored the related issue in When a compromised administrator does not mean a compromised identity.

What QEI could not solve on its own

QEI is a research concept, not a deployed or certified security product. By itself, it cannot prevent every ransomware attack, application vulnerability, data-centre failure or denial-of-service incident.

Identity safeguards do not replace secure endpoints, backups, network segmentation, incident response, staff training or organisational controls. Proposed QEI mechanisms could themselves create costs, dependencies and new points of failure. Technical testing, independent security review and legal assessment would be required before any real-world adoption.

How could a research pilot test the idea?

A limited pilot would need measurable criteria, for example:

• whether a compromised administrator could bypass controls on identity records;
• whether sign-in and authorisation of an individual transaction can be independently distinguished;
• how quickly compromised permissions can be revoked and restored safely;
• how essential verification behaves if a central service is temporarily unavailable;
• how little personal data must be disclosed for a defined purpose;
• which operational and security risks the proposed architecture itself introduces.

Credible research must allow for negative findings, too. A proposed approach may prove unsuitable for certain environments.

Conclusion: trust needs independent safeguards

Recovering an interrupted service matters. But lasting trust requires more: reliable data, limited permissions, verifiable authorisation and a safe path back from compromise.

The next step in digital security may be not merely stronger login, but a clearer separation of identity, authority and trust. That is one of the research directions behind QEI, pursued with privacy rather than surveillance as the guiding principle.

Explore the broader context at QEI – Research & Development.

Sources and further reading

• 24ur.com – Kibernetski napad lahko v sekundah zamaje leta zaupanja (15 October 2026, Slovenian).
• ENISA – Cyber Threat Landscape.
• European Banking Authority – Digital Operational Resilience Act (DORA).
• European Commission – NIS2 Directive.

This is an independent research article by Institute 1 April. QEI capabilities discussed here are proposals, not verified functions of a deployed system, and mentioning external institutions does not imply collaboration.