Family offices are becoming prime targets for cyber hacks and ransomware

A version of this article first appeared in CNBC’s Inside Wealth newsletter with Robert Frank, a weekly guide for wealthy investors and consumers. To register to receive future editions straight to your inbox.

Family offices are increasingly under attack from cybercriminals, and many don’t have the staff or technology to prepare, a new study shows.

More than three-quarters, 79%, of North American family offices say the likelihood of a cyber attack has “increased dramatically in recent years,” according to a survey of single-family offices by Dentons, a global law firm. A quarter of family offices surveyed reported that they would experience a cyber attack in 2023, up from 17% in 2020. Half say they know another family office that has fallen victim to a cyber attack, the survey found.

With their vast wealth and small workforces, family offices have become lucrative targets for hackers and cybercriminals, experts say.

“It’s the Willie Sutton effect,” says Edward Marshall, global head of family office and wealth at Dentons, referring to the famous bank robber who targeted banks “because that’s where the money is.”

Marshall said family offices are often short-staffed with access to highly sensitive information about a wealthy family’s finances and private companies. Because family offices value efficiency and speed over risk management, today’s family offices often lack adequate technology and planning for potential cyber attacks.

“Family offices often have a preference for efficient service versus security,” he says.

Using in-house security teams can be expensive for family offices, he added, while using third-party vendors also poses risks from “sophisticated criminals and bad actors.”

However, the growing fear of cyber attacks has not yet translated into better defenses. According to the survey, less than a third of family offices say their cyber risk management processes are well developed. Only 29% say their workforce and cyber training programs are “adequate,” and less than half say they have upgraded workforce training programs or regularly update cyber policies.

“These findings show an alarming gap between awareness of cybersecurity risks and the actions taken to prevent and deter attacks,” the report said.

A separate report from EY US and the Wharton Global Family Alliance states that family offices must address cybersecurity by addressing each of the three key components of technology risk: hardware, software and applications.

Instead of sending emails with financial or personal information, the report recommends family offices use a website or intranet site. The report also suggests the use of password vaults and better control of technology providers for security.

Marshall said family offices need to take a more proactive approach to the overall assessment, which goes beyond cyberattacks.

“They need a change in mindset from accepting the unexpected to expecting the unexpected,” he said.

Sign up to receive future editions of CNBCs Within wealthnewsletter with Robert Frank.