Hackers have long targeted financial firms, and the reasons are easy to understand. Motivated by monetary gain, who better to prey on? High-value data, infrastructure sprawl, and the operational pressure to resolve incidents quickly and quietly create a natural concentration of what hackers seek out.
But what are the costs for the firms being targeted?
The average cost of a data breach in the financial sector comes in at a staggering $5.56 million per incident, according to IBM’s “Cost of a Data Breach Report.” This figure encapsulates the steep price of recovery to include regulatory penalties, litigation settlements, and remediation efforts.
Still seem high? Let’s take an in-depth look at the contributing costs for a mid-sized financial firm.
The Cost of Reputational Damage
Very few things are as personal to people as their finances. Because of this, the underlying success of financial services organizations depends, by and large, on their reputation. This is perhaps more true than any other industry.
For instance, a bad experience at a retail store is fixed with a refund. You’ll forgive a frustrating flight if the airline gives you free rewards miles. An underwhelming meal isn’t so bad after it’s been comped.
However, there's no equivalent remedy when it’s your financial security that has been compromised. Indeed, according to one study, corporate reputation accounts for an average of 63% of a company's total market value.
Historically speaking, underperformance, predatory practices, and outright fraud were the major fault lines that eroded a financial firm's reputation and trust. More recently, how firms respond to cyberthreats has become an additional benchmark to measure trust.
It's sort of a double-edged sword. A breach that is handled well, communicated early, and resolved transparently can leave a firm's reputation bruised but intact. But firms that stumble in their response through obfuscation and deceit often find the response more damaging than the breach itself.
The difference between those two outcomes is the difference between a run on the bank and a flood of new customers.
Exposure to Regulatory Fines
Over the years, a myriad of local, state, and federal laws, rules, and regulations have been implemented to limit the ripple effects of financial cyberattacks. In this section, we’ll highlight a few key mandates that set the bar for cybersecurity best practices and data protection across the industry.
SEC Cybersecurity Rules 2023
To protect investors amidst a growing threat landscape, the SEC now requires public companies to more rapidly disclose cybersecurity incidents that have a "material impact" on their business. The rule imposes a strict four-day deadline to publicly report the scale and scope of any attack deemed “material.” It also introduces an annual requirement for companies to outline their cybersecurity risk management and governance strategies.
The cost of non-compliance is astronomical, with fines reaching upwards of $25 million, in addition to suspension of certain privileges.
While SEC regulations typically govern publicly listed companies, we highlight this rule for two reasons. First, its swift and detailed reporting standards are becoming a framework for lawmakers. Second, private entities may still be bound by these rules if they’re owned or controlled by a public corporation.
FTC Act Section 5
Whereas the SEC rules pertain to public companies, Section 5 of the FTC Act is a federal law, much broader, affecting virtually any US-based company. Many see it as a catch-all that can be enforced even when a company is able to skirt other cybersecurity laws and regulations on technicalities. Namely, under Section 5, it is unlawful to engage in "unfair or deceptive" business practices.
Throughout its lifetime, it has been applied to companies that claimed to have implemented robust cybersecurity practices only for those claims to later be exposed as dubious. Penalties run up to $100,000 per violation at the company level, and individual executives can be personally exposed to fines of up to $10,000.
New York SHIELD Act (RETURN)
For the better part of a century, New York has been the preeminent financial capital of the world. Even if your firm is based in another state, if you conduct business in New York, this law applies.
The SHIELD Act amends an older law by “expanding the types of private information for which companies must provide consumer notice in the event of a breach.” And requires “that companies develop, implement, and maintain reasonable safeguards to protect the security, confidentiality, and integrity of the private information.”
Furthermore, organizations are obligated to notify the Office of the New York State Attorney General, the New York Department of State, and the New York State Police of cyber incidents impacting customer data.
California CCPA / CPRA
It’s common for companies in the financial sector to buy and sell customer data, even if that’s not their core business. That said, if your company buys, sells, or otherwise shares personal information of 100,000 or more people, there’s a good chance you’ll need to abide by the regulations outlined in California CCPA /CPRA. Like NY Shield, even if you’re based outside of the state of California, if its residents are a part of your data collection / sharing, this rule applies.
Civil penalties of $2,663 to $7,988 per affected person are the standard.
Digging Deep Into the Recovery Costs
Getting back on your feet after a serious attack is no small feat. There will be technical man-hours and other post-mortem costs involved. Let’s take a look.
External Incident Response Team
Financial firms require cyber incident response strategies that go beyond standard playbooks. And since most firms lack the in-house expertise to build and implement these frameworks themselves, outsourcing is an industry norm.
Due to the highly specialized nature of the work, elite financial IR consultants can command rates exceeding $500 per hour.
Forensic Investigation
Containing an attack stops the bleeding. Understanding and fixing the root cause is how you move forward.
How did the attackers enter? How long did they linger? What did they access? What did they take? To answer these questions requires forensic professionals to reconstruct the full timeline of events.
Mainstream financial regulations require a documented, court-defensible account of any breach, making forensic investigators an indispensable role in the wake of an attack.
Legal Counsel
While mid-sized financial firms usually maintain in-house counsel to handle day-to-day legal demands, a significant cyber incident is outside of their wheelhouse.
Regulatory response, breach notification, and civil litigation exposure each require a depth of specialization. As such, firms typically retain outside legal specialists to manage these efforts.
Crisis Communication
A breach creates several audiences. Regulators need formal notification. Customers need reassurance and honesty. The press needs a soundbite to run. And the list goes on.
Managing all of this without causing chaos is best handled by a crisis communications firm. A qualified firm brings the message-crafting, established relationships, and institutional composure to project credibility and transparency.
Ransomware Payment
Of all recovery costs, none puts a firm in a more difficult position than the ransom demand itself.
Pay it and risk potential regulatory scrutiny, sanctions exposure, or worse. Refuse it and face a recovery timeline that may stretch into weeks.
Small and mid-sized firms, in particular those without cohesive backup systems, tend to find themselves tilted toward payment. Research from 2022 and 2024 shows, “the financial services industry accounted for 432 incidents totaling approximately $365.6 million in reported payments, second only to the manufacturing industry.”
Downtime Costs
Most industries can absorb some amount of downtime. Financial services largely cannot. When the full picture is assembled, lost transaction revenue, idle staff hours, and missed market activity cost financial services institutions “an average of $309 million a year.”
Build a Future-Ready IT Strategy
Our experts help growth-minded businesses scale securely and proactively. Reach out today to see how we can align your technology with your long-term goals.
Industry Insights
Explore trends, insights, and guidance from technology leaders.