In brief: Financial services firms account for one in five data breaches globally, according to new research by Kroll, putting the sector ahead of professional services and healthcare. Third-party suppliers are identified as the primary vector for wider damage, and Kroll’s Jersey office says the findings should resonate clearly across the Channel Islands.
Finance Leads the Breach League Table
If you thought the biggest threat to a financial services firm was a rogue trader or a dodgy investment, think again. Research by global financial and risk advisory firm Kroll has found that financial services made up 20% of all organisations breached between June 2025 and June 2026, placing the sector firmly at the top of an unwanted league table, ahead of professional services and healthcare.
The findings are drawn from incidents handled by Kroll’s Cyber and Data Resilience team and a survey of 250 business leaders, risk professionals and board members. Almost seven in ten organisations surveyed said they had suffered a data breach in the previous year, and more than a third reported being breached more than once. Cyber incidents, it seems, are no longer a question of if, but how often.
Ed Shorrock, co-managing director of Kroll’s Jersey office, was direct about the implications for the Channel Islands. “The fact that the financial services continues to be the sector experiencing the most breaches at a global level should resonate clearly in Jersey and Guernsey,” he said, as reported by Bailiwick Express.
The Weak Link in the Chain
Perhaps the most striking finding is not where breaches begin, but how far they travel. According to the report, 69% of affected individuals were impacted through a third-party breach, illustrating how a single compromised supplier can create cascading problems for hundreds of connected businesses.
Shorrock noted that across most of the major incidents Kroll handled over the past year, “a vendor, software supplier or service provider was the link between the initial breach and the organisations affected.” For Jersey’s finance industry, which relies on a dense network of technology providers, legal firms, fund administrators and other specialist suppliers, this is not an abstract concern.
The sector breakdown of third-party impact is particularly telling. Technology companies ranked only seventh by the number of organisations breached, but first when it came to the number of people affected. Kroll found that 79% of individuals caught up in third-party breaches were affected by incidents originating in the technology sector, compared with 9% linked to finance and 6% to insurance. In other words, a breach at a software provider can do far more collective damage than a breach at a bank.
A Disconnect at the Top
The report also reveals a notable gap between those who understand the risk and those who set the agenda. More than half of technology leaders rated vendor breaches as their biggest compliance risk, yet fewer than a third of risk and compliance leaders shared that concern. That is a significant disconnect, and one that could leave organisations exposed precisely because the people with the authority to act are not yet treating supplier risk with the same urgency as their IT colleagues.
Looking further ahead, Kroll expects artificial intelligence to complicate matters considerably. Malin Nilsson, co-managing director of Kroll’s Jersey office, warned that as AI agents are given greater access to systems and sensitive data, “breach risk rises across both human and non-human identities.” She added that data and identity governance are becoming increasingly complex, and that AI is expected to feature more prominently in Kroll’s next annual Data Breach Outlook, both as a tool used by attackers and as a source of exposure for businesses adopting it.
Kroll’s practical advice is straightforward: organisations that map their supplier relationships and establish response plans before an incident occurs are typically better placed to limit both the disruption and cost of a breach.
Source: Bailiwick Express
