Very few organisations combine this much financial authority with this little institutional scale. A family office may hold banking mandates, custodial relationships, entity structures across several jurisdictions and the personal data of a family whose names appear on buildings — and administer all of it with a dozen people, no dedicated security function, and an IT arrangement inherited from whichever adviser set the office up. Attackers understand that arithmetic rather better than the industry has generally acknowledged.
How often it is already happening
Deloitte Private’s Family Office Cybersecurity Report 2024, based on a global survey of 354 single-family offices conducted between September and December 2023, found that 43% had experienced a cyberattack in the previous 12 to 24 months. A quarter of the total had experienced three or more separate attacks. Exposure was uneven: North American offices reported the highest attack rate at 57%, against 41% in Europe and 24% in Asia Pacific, and 62% of offices above $1 billion in AUM reported an attack against 38% of those below. The data establishes an association between scale and attack frequency; it does not, on its own, explain the mechanism, and reporting rates may themselves differ by size and region.
What the figures do settle is the question of whether this is a prospective risk. For a substantial minority of the industry, and something close to a majority in North America, it is an operating event that has already occurred.
The way in is almost always a person
Among offices that were attacked, 93% experienced phishing, well ahead of malware at 35% and social engineering at 23%. The figure describes victims rather than the whole sample, and stating it precisely matters, because it points somewhere a technical account of cyber risk tends not to look. The dominant vector is not a novel exploit against infrastructure. It is a message plausible enough that someone inside the office — or a family member outside it — acts on it quickly.
Family offices are unusually well suited to that attack. Payment instructions arriving from a principal who travels, is difficult to reach and is not accustomed to being questioned; small teams where a single individual can initiate a transfer; a culture of discretion that discourages the sort of loud verification a bank operations desk performs as routine. Technical controls reduce how often such attempts land. They cannot remove the underlying exposure, because the exposure is a person making a fast decision under social pressure.
Widely adopted controls, thinly spread preparedness
The problem is not an absence of security measures. Deloitte found 85% of family offices using strong passwords or multi-factor authentication, and 72% maintaining regular data backups. Beyond that baseline the picture thins quickly. Only 58% provide cybersecurity staff training and just 34% have conducted a maturity assessment to establish where their vulnerabilities actually sit. Half have no disaster recovery plan; 63% carry no cybersecurity insurance; 68% have not adopted “know your vendor” protocols for external parties with data access.
There is an uncomfortable symmetry in that list. The measures that have been widely adopted are the ones that can be implemented once and largely forgotten. The measures that have not are the ones requiring sustained organisational effort — and, given the dominance of phishing, they are also the ones that address the way these offices are actually being attacked.
Having a plan and trusting a plan
The report’s starkest finding concerns the aftermath rather than the prevention. Nearly a third of family offices, 31%, have no cyber incident response plan. A further 43% have one they themselves describe as a plan that “could be better”. Only 26% consider theirs genuinely robust. Fewer than three in ten, in other words, believe they hold a response capability they would rely on in the moment — against an attack rate of 43%.
The 43% in the middle are, in effect, filing a self-assessment. A plan nobody has rehearsed, whose authority lines have never been tested against a live incident on a Friday evening, offers rather less protection than its presence on a shared drive implies. The consequences are visible in the same data: a third of offices that were attacked suffered loss or damage, most commonly operational damage including loss of confidential data, affecting 20% of victims, and direct financial loss, affecting 18%.
The perimeter runs through other people’s systems
A family office’s security perimeter has never stopped at its own walls, and stops considerably further away than it used to. Custodians, banks, administrators, accountants, lawyers, investment managers and technology vendors each hold some measure of access to sensitive family and financial data. Every one of those relationships extends the office’s exposure by exactly as much as it extends its capability, which is why the 68% figure on vendor protocols is more consequential than it first reads.
This is not an argument for treating long-standing advisers as counterparties of unknown quality. It is an argument that access — who holds it, what it reaches, how it is reviewed and how it is revoked when a relationship ends — belongs inside the office’s governance, not inside an assumption that professional firms are secure because they are professional.
Who owns this
None of the gaps above is closed by a purchase. They are closed by answering questions that sit with principals and executives rather than with whoever administers the laptops. Who owns cyber risk by name, rather than by default when something goes wrong? Who has authority to halt a payment, isolate a system or engage counsel during a live incident, and has that authority been exercised in a rehearsal? What happens if the party compromised is a trusted provider rather than the office itself? Which information is classified as most sensitive, and who can actually reach it — a question the maturity-assessment figure suggests two-thirds of offices have not formally put to themselves.
Only 22% of family offices rank cybersecurity as a top organisational risk, and 15% describe strengthening it as a core priority for the year. Those two numbers, held against a 43% attack rate, are the finding that ought to travel furthest. An industry that has already been attacked at scale is, for the most part, still ranking the risk as though it had not been. The offices that have given the problem an owner, a tested plan and a review cycle are not better protected because they bought better software. They are better protected because someone is answerable for it.
"An office can have excellent internal password hygiene and still be exposed through a vendor whose security posture nobody has ever assessed."