Cybersecurity for Financial Services

Criminals target financial firms mainly to move money out of client accounts or to steal the identity data that lets them open or take over accounts. The most common routes:

Business email compromise. The FBI's 2025 IC3 report counted 24,768 BEC complaints and about 3.05 billion dollars in reported losses; across all crime types, California reported more losses than any other state.

Account takeover. Criminals use stolen credentials or spoofed client emails to request distributions, change bank details, or redirect statements. The SEC's fiscal 2026 examination priorities call out account takeovers and fraudulent transfers under Regulation S-ID.

Credential theft against custodian portals, CRM, and Microsoft 365, often through phishing pages that look like a familiar login screen.

Attacks on vendors, where a breach at a service provider exposes your clients' information even though your own office was never touched.

A Regulation S-P incident response program must be written and reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information. In practice it needs:

Procedures to assess the nature and scope of an incident and contain it to prevent further access.

Notice to affected individuals as soon as practicable, but no later than 30 days after learning that sensitive customer information was or is reasonably likely to have been accessed or used without authorization, unless a reasonable investigation shows it is not reasonably likely to cause substantial harm or inconvenience.

Service provider oversight, including due diligence, monitoring, and a requirement that providers notify you within 72 hours of a breach in systems they maintain.

Written records documenting compliance with the safeguards and disposal rules.

Firms under the FTC Safeguards Rule have a parallel duty: notify the FTC within 30 days of discovering a breach involving unencrypted information of at least 500 consumers. In California, Civil Code 1798.82 also requires notice to affected residents, with a sample sent to the Attorney General when more than 500 are affected.

Financial firms need controls that stop stolen credentials and fraudulent requests, catch intrusions quickly, and let the firm recover without paying a ransom. For firms under the FTC Safeguards Rule, multi-factor authentication and encryption of customer information are written into the rule itself. HD Tech's The Watch Tower package covers most of this list:

Multi-factor authentication on email, custodian portals, CRM, and remote access, with phishing-resistant methods for administrators.

Email security that screens for impersonation of clients, executives, and custodians.

Managed detection and response on every device, backed by a 24/7 SOC.

Dark web monitoring and vulnerability scanning to find leaked passwords and unpatched systems first.

Immutable backup and a written, tested incident response plan.

Paul Morton, CISSP, leads our cybersecurity consulting. A useful first step for any firm is a tabletop exercise that walks leadership through a simulated breach and the notice decisions it would trigger.