The global cost of a data breach, and what changed in three years.

The global cost of a data breach last year was USD $4.45 million — an increase of 15% over three years. The figure comes from IBM’s annual Cost of a Data Breach Report, and it represents the average across all industries. For financial services and wealth management, the number is considerably higher.

What changed

Three years ago, the average breach cost $3.86 million. The 15% increase tracks a period in which the attack surface expanded dramatically: remote working became permanent, cloud adoption accelerated, and the supply chain became a primary vector for financially motivated actors.

For a small firm — a family office, a trust company, a wealth manager with ten to thirty professionals — the relevant number is not the average. It is the tail risk. A single successful phishing campaign that results in wire fraud, or a ransomware event that locks client records ahead of a regulatory deadline, can cost multiples of the headline figure.

The threats most relevant to this sector

Business Email Compromise (BEC). Attackers impersonate principals, counterparties, or banks to redirect transfers. The FBI estimates BEC losses exceeded $2.9 billion in 2023 alone. Family offices and wealth managers are disproportionately targeted because the transaction values are high and the organisations are small enough to have informal approval processes.

Ransomware. Encryption of client files and the threat of public disclosure of confidential financial data. Recovery times for unprepared firms run to weeks. For firms with regulatory reporting obligations, the timing of an attack is often not coincidental.

Identity-based attacks. Credential stuffing, SIM swapping, and MFA fatigue attacks against the Microsoft 365 environments that most firms now rely on. Default configurations are not sufficient.

What a properly run environment looks like

The architecture Astris CSP deploys starts with Microsoft’s highest available security baseline — the configurations that most regulated financial institutions do not enable internally, because they were designed for environments larger than the firms we serve.

Continuous monitoring, structured incident response, and board-level reporting mean that a breach, if it occurs, is detected in hours rather than weeks. The IBM data is clear: detection speed is the single largest driver of breach cost. Firms that detect and contain a breach within 200 days spend an average of $1.02 million less than those that do not.

The right question is not whether to invest in cybersecurity. It is whether the investment is configured correctly for the sector you operate in.