IN THE dusty hills north of Madrid, in low-slung buildings guarded closely like bank vaults of old, are the rows of servers that run the far-flung banking empire of Santander, a big international bank. Ever since the 2001 attacks on the World Trade Centre, banks like Santander have invested billions in safeguarding and duplicating their data centres to protect them from terrorist attacks and natural disasters.

The threat against banks has, however, evolved. Although the physical infrastructure of the world's financial system is largely secure, the software that runs on it is not. Bank bosses and regulators are becoming more concerned by the threat posed to financial stability by networks of hackers that have launched a series of attacks on banks over the past few months.

In that time some 30 large global banks, mostly American, have suffered from a series of assaults designed to shut down their websites. These attacks are known as distributed denial of service (DDoS) attacks because hackers harness an army of infected computers to bombard the target with internet traffic with the intention of overloading it. They are relatively unsophisticated. But they have periodically frustrated customers trying to use online services at banks including JPMorgan Chase, Wells Fargo, Citigroup and PNC.

They have also shown some novel features, such as the conscription of computers in "cloud computing" data centres, increasing the amount of spurious traffic generated. Several people familiar with these attacks say there are strong indications that the hackers are state-backed; many suspect the involvement of Iran.

The attacks have caused little more than brief inconvenience, mainly because they were targeted at the public face of the affected banks rather than their connections to other banks and to payment systems. Even so, they have brought to light vulnerabilities in banking and payment systems. Ross Anderson, a professor of security engineering at the University of Cambridge, frets that hackers could cause mayhem if they were to aim DDoS attack at banks' crucial infrastructure instead of their websites. "If 20,000 machines started hammering British payment gateways on the last weekend before Christmas, people wouldn't be able to shop except with cash," says Mr Anderson.

Another risk is that hackers may graduate from crude DDoS attacks to more sophisticated ones that secretly penetrate banks' systems and then steal or delete data. "From what we've seen … the threats haven't been life-threatening," says one regulator. "At the same time we want to be ahead of this curve. The fundamental challenge is that the risk morphs quickly and can be difficult to detect."

The official responses include increasing regulators' oversight of banks' computer systems and war-gaming attacks on banks and the networks that connect them. Yet much remains to be done. At the moment banks have little incentive to share information on attacks and vulnerabilities with regulators or competitors. Supervisors also appear to be unwilling to talk publicly about their concerns or about investigations into lapses by banks, such as the systems failure in mid-2012 at the Royal Bank of Scotland that left many customers unable to carry out transactions.

One step is for regulators explicitly to acknowledge that an IT failure at one bank can spread financial instability or undermine trust in payment methods such as debit cards. They could then grade banks publicly on the quality of their systems and force them to improve things if they fall short of required standards.

But that approach raises another, thornier question: whether governments should just force banks to invest more of their own money in cyber-security, or whether they should devote their own resources to protecting banks from attacks by enemy states and their surrogates? "No one in the United States is expected to provide for their own air defence," points out Richard Bejtlich of Mandiant, a computer-security firm. "We have an army to repel a land invasion, so who is out there protecting the cyber lanes of control? Nobody. It is a free for all."