Financial Firms Lead Data Breach Victims in Kroll Report
Kroll's latest data shows financial services made up a fifth of breached organisations, with vendors driving much of the fallout.
Updated on Nov. 11, 2026 in Cybersecurity
Live Poll
Do you trust companies that hold your personal data to keep it secure?
Kroll reported that financial services accounted for 20% of organisations breached between June 2025 and June 2026, ranking ahead of professional services and healthcare. Almost seven in 10 organisations surveyed reported a data breach in the previous year.
Why it matters
The findings point to third-party suppliers as the main channel through which breaches spread to multiple organisations and individuals. For readers in Jersey and Guernsey, where Channel Islands finance is referenced, the concentration of risk in shared vendors is a relevant consideration.
Kroll's analysis covers incidents handled by its Cyber and Data Resilience team alongside a survey of 250 leaders, but the report does not identify specific vendors or software suppliers behind the breaches. Technology companies ranked first by number of individuals affected, with 79% of third-party-affected individuals linked to technology-sector incidents.
The players
Kroll
Kroll is a global risk and financial advisory firm whose Cyber and Data Resilience team handles major breach response and publishes annual data breach analysis.
The details
Across most major incidents Kroll handled over the past year, a vendor, software supplier or service provider linked the initial breach to the organisations affected. More than half of technology leaders rated vendor breaches as their biggest compliance risk, and more than a third of surveyed organisations reported being breached more than once.
Timeline
June 2025 to June 2026: period covered by Kroll's breach data showing financial services at 20%.
Previous year: almost seven in 10 surveyed organisations reported a data breach.
Next year: Kroll expects artificial intelligence to feature more prominently in its Data Breach Outlook.
Under the Hood
The report sits within Kroll's annual Data Breach Outlook series, which this year adds sector rankings and a breakdown of third-party breach exposure. Kroll says it expects artificial intelligence to feature more prominently in next year's edition.
Customers of banks, insurers and their software suppliers may find their personal data exposed even when their own provider was not the direct target. Checking whether a provider has disclosed a third-party incident is a practical step for anyone whose financial data is held by multiple services.
The takeaway
Security reviews that stop at a firm's own systems miss the suppliers that often carry the greatest exposure. Boards and customers alike should ask who else holds their data.
Further reading
For broader context on how supplier weaknesses drive breaches, see Cybersecurity coverage on Wisevoter.
Source note: This article includes information reported by Bailiwick Express News Jersey.
Live Poll
Do you trust companies that hold your personal data to keep it secure?
