Financial Institutions Could Be Liable for Third-party Data Breaches: Allianz

Allianz Global Corporate & Specialty (AGCS) has released a lengthy new report that details many of the major challenges that financial institutions will face in the next few years. The findings are based on a survey of more than 900 industry respondents and supplemented with an analysis of 7,654 insurance claims worth roughly $1.05 billion.

Those industry responses were used to put together an Allianz Risk Barometer that ranks stakeholders’ various concerns. The top spot went to cybersecurity incidents, a category that includes cyberattacks and data breaches. The pandemic and business interruption were some of the other things that had a negative impact on the financial sector. The respondents also expressed concern about the changing regulatory environment, which covers both data protection legislation and green legislation intended to curb climate change.

Of those, cyber incidents triggered the largest losses for financial institutions. However, AGCS warned that compliance could create even more problems moving forward, since organizations that fail to comply with newer, stricter regulations (and organizations that fail to protect people’s personal and biometric data in particular) could face greater fines and expose themselves to costly civil litigation.

That remains true despite the financial industry’s considerable investment in cybersecurity. Financial institutions are a lucrative (and popular) target for cybercriminals, and the reliance on third-party service providers creates a potential weak link in the security chain. A bank could still face consequences for a data breach that originates with a third-party partner, with AGCS citing the recent SolarWinds incident as one noteworthy example.  

“How financial institutions manage risks presented by the cloud will be critical going forward,” said AGCS North America Head of Cyber, Tech, and Media Thomas Kang. “They are effectively offloading a significant portion of cyber security responsibilities to a third-party. However, by partnering with the right cloud service provider, companies can leverage the cloud as a way to manage their overall cyber exposure.”

AGCS went on to suggest that some financial institutions could face lawsuits from shareholders dissatisfied with an organization’s COVID-19 response. The report also tracked 170 new Environmental Social and Governance (ESG) laws that have been passed since 2018, arguing that financial institutions should be prepared to comply with those laws, and with laws that address other social issues like diversity and executive compensation.

–

May 11, 2021 – by Eric Weiss