Cyber risk: the governance item family offices underweight

Cyber risk is the governance item family offices most consistently underweight: the attack rate is high, the control rate is low and the gap between the two has been visible in every survey since 2024. Deloitte's Family Office Cybersecurity Report 2024 found that 43% of family offices had experienced an attack in the previous 12 to 24 months and that 31% had no incident response plan. UBS's Global Family Office Report 2026, as reported by Canadian Family Offices, found only about 40% of 307 offices have cyber security controls. Family offices combine concentrated wealth, small teams, informal communication with principals and extensive use of outside providers, which is the profile attackers prefer.

The incident data

The Deloitte figures show that size attracts attack: 62% of offices above $1bn had been hit against 38% of smaller ones, and 46% of the larger group had suffered three or more attacks. Bank of America's 2025 Family Office Study found nearly one-third of 335 North American offices or their family members had been attacked, 39% had experienced fraud and family members were the most frequent victims. The RBC and Campden Wealth 2026 North America report, covered by Wealth Professional, recorded the sharpest change: 59% of offices reporting phishing attempts and 59% ranking cyber as their top near-term operational concern, both up from 16% a year earlier.

Common attack types

Phishing dominates. Deloitte found it was involved in 93% of attacks on affected offices, followed by malware at 35% and social engineering at 23%. The family office variant is business email compromise: an attacker impersonates the principal, a lawyer or a fund administrator and instructs the office to wire money. The FBI's 2025 Internet Crime Complaint Center report, summarised by McDonald Hopkins, recorded $3.046bn of business email compromise losses in 2025 across 24,768 complaints, the second-largest loss category after investment fraud, within total cyber-enabled losses of $20.877bn, up 26% on the year. Capital call notices are a particular exposure because they arrive by email, are expected and are time-sensitive. About a third of Deloitte's victims suffered loss or damage.

The preparedness data

Controls are partial. Deloitte found 85% of offices use strong passwords or multi-factor authentication and 72% back up data, but 58% train staff, 34% run maturity assessments, 50% have no disaster recovery plan, 63% have no cyber insurance and 68% have no know-your-vendor protocol. Only 26% described their incident response plan as robust; 43% said it could be better. Citi's 2025 Global Family Office Report found 31% of 346 offices lack cyber controls, 39% have no disaster recovery plan and 48% feel confident in managing cyber risk. J.P. Morgan's 2026 Global Family Office Report, as summarised by Gulf Business, found 38% of offices outsource cyber security and 32% name it as their greatest service need. Bank of America found 42% rely on external IT specialists, 53% of executives feel knowledgeable about threats and 46% say next-generation family members have received cyber education.

The governance point is that cyber sits in the part of the risk framework that most offices have not built. UBS's 2026 report found only 28% of offices have a risk management process extending beyond investments. Where there is no risk register, cyber has no owner, no budget line and no place on the board agenda.

Minimum controls

A family office with a small team can reach a defensible position with a limited set of measures. Multi-factor authentication on every account, including the principals' personal email, which is usually the weakest link. A call-back rule on every payment instruction received by email, using a number held on file rather than one in the email, with no exceptions for the principal. Dual authorisation on wires above a threshold. Separate devices or at least separate accounts for family members' personal and office activity. Patching and endpoint protection managed by a provider under a written service level. Encrypted, tested, offline backups. A one-page incident response plan naming who to call, including the bank, insurer, counsel and a forensic firm, with the contract for the forensic firm signed in advance. Annual phishing simulation for staff and family. Vendor due diligence covering administrators, custodians and reporting platforms, since the data these hold is the office's data. Cyber insurance, which 63% of Deloitte's respondents lacked, sized to the wire fraud exposure rather than the data breach exposure.

The board should receive a short cyber report each quarter: incidents, near misses, training completion and open vendor issues. Cyber belongs in the same risk process as liquidity and concentration, discussed in what a governance framework contains, and the reporting platforms it threatens are covered in reporting to the family.

The controls above cost less than one successful wire fraud, and the data show most offices have not yet put all of them in place.