The call every bank CISO dreads is not about their own systems. It is about a vendor’s. That scenario played out when EY, one of the world’s largest professional services firms, was breached for 11 days — long enough for intruders to reach data belonging to wealth management clients of Goldman Sachs. The incident is a landmark not because either firm’s own defences were the story, but because the connection between them was.
The Concentration Problem
Modern finance runs on a handful of giant service providers. The Big Four audit firms, a few core-banking platforms, two or three cloud hyperscalers — compromise any one of them and you inherit access, context or data touching dozens of institutions. Attackers understand this concentration better than many boards do, and advisories from CISA have repeatedly flagged professional services as a preferred beachhead into better-defended targets. Our finance coverage has tracked the shift of attacker attention from vaults to hallways.
Why Wealth Client Data Is the Crown Jewels
Retail banking data enables fraud. Wealth data enables something more personal: precisely targeted deception. Knowing a client’s advisor, holdings, family office staff and transaction timing allows attackers to craft approaches indistinguishable from legitimate private-banking contact. Reporting on comparable exposures by KrebsOnSecurity shows how such data circulates in criminal markets for years, monetised slowly and carefully against victims who can afford to pay.
Eleven Days of Dwell Time
Dwell time is the metric that turns an intrusion into a breach. Eleven days lets a disciplined attacker map repositories, identify the valuable archives and stage exfiltration beneath normal traffic. The questions that follow — which credentials, which access controls, which alerts fired and when — will occupy regulators and both firms’ response teams for months, and the answers will shape vendor-security expectations across the sector.
Rewriting the Vendor Rulebook
The Insurance and Litigation Tail
Breaches of this sensitivity generate long tails. Notification obligations ripple across jurisdictions; regulators in multiple countries can claim an interest; and the plaintiff bar has refined wealth-data cases into a speciality, arguing that the harm is not hypothetical when the exposed population is defined by its assets. Cyber insurers, meanwhile, are repricing the entire professional-services category, demanding evidence of controls that questionnaires once sufficed to assert.
Clients are also rewriting contracts. Expect shorter data-retention windows imposed on vendors, explicit breach-notification clocks measured in hours, and audit rights exercised in fact rather than in filing cabinets. The market is learning to price trust — and after an 11-day intrusion reached from an auditor into a bank’s wealth clients, trust’s price has gone up. Firms that can demonstrate their controls, continuously and convincingly, will win the mandates of those that merely assert them.
There is a final, uncomfortable symmetry to sit with. The firms most exposed to this class of incident are exposed precisely because they are trusted — because clients hand them the data that makes the modern financial system function. Trust built the concentration; concentration built the target. The work of the next decade, for banks and their auditors alike, is to keep the trust while dissolving the target: less data held, for less time, under continuously verified controls. Nothing about that programme is glamorous. Everything about it is now unavoidable.
The direction of travel is clear: continuous vendor monitoring over annual questionnaires, contractual rights to evidence and audit, strict data-minimisation so vendors hold less for shorter periods, and joint incident rehearsals. The EY–Goldman episode teaches a lesson finance keeps relearning at rising prices — you can delegate the work, but the risk stays on your own balance sheet. Keep reading our analysis via our homepage.
