By Ian Weisberger, co-founder and CEO of CoinRoutes.
In financial services, 2026 has been the year of the constant cyberattack. Whether it is wealth managers losing clients’ Social Security numbers to stolen logins, employees tricked into revealing customer data or botnets hammering firms with AI-generated password attempts, these threats are hitting companies on a near-weekly basis.
With AI making attacks easier, the pace is unlikely to slow. Financial services companies understand that breaches are becoming a fact of life. What they cannot accept, though, is being left in the dark. In financial services, especially in fintech and fast-growing areas such as decentralized finance, communication after a breach has too often been lacking.
Speaking Up Versus Going Quiet
To understand the problem, it’s worth starting with what good looks like. In September, Revolut was reported to have suffered a data breach involving fraudulent government data requests. The firm acknowledged the incident, said it had contacted affected customers directly and described steps it took to block the fraudulent requests and notify relevant authorities.
Later that month, when Bitget reportedly suffered a hack involving more than $350 million, CEO Gracy Chen publicly addressed the impact, explaining the withdrawal suspension and stating that the company would cover the losses.
Neither company had every answer at the outset, but these examples illustrate an important principle of incident communications: acknowledge what is known, explain what remains uncertain and give customers clear information about the steps being taken. That approach can help preserve trust even when the full picture is still emerging.
Not every incident is accompanied by the information clients need to understand the risks. A few weeks ago, we began receiving questions about a cyberattack involving a portfolio management service provider we work with. Our systems were not affected, but we share several clients with the provider, leaving us with questions we could not yet answer.
At the time of writing, we were still seeking details about the incident, including what information may have been exposed and how the attackers gained access. Although the provider had indicated that it would share a post-incident review, we did not yet have the information needed to address our clients’ concerns.
Many clients came to us looking for answers, and we had concerns that trading histories and portfolio data could have been exposed. For a trading firm, that can be enough to work out its strategies, among the most valuable things it owns. We asked for details that would have put those concerns to rest, but they did not arrive.
How Silence Becomes Everyone’s Problem
In financial services, a provider’s clients can collectively manage hundreds of billions of dollars, and they have their own obligations to investors, shareholders and regulators. If providers cannot explain what data was taken, they cannot tell their own clients, and one firm’s silence puts everyone in a difficult position.
This matters most in the newer corners of finance. Sectors such as decentralized finance are still earning the trust of businesses and consumers, with far less reputation to fall back on than an established bank. When something goes wrong, silence costs them more than anyone.
In our own operations, we’ve made timely incident reporting a contractual obligation, committing to investigate incidents and provide clients with a post-mortem within 24 to 48 hours. Because we run a trading system around the clock, we write one even for five-minute outages. For consumer-facing businesses, I would expect a first message closer to an hour. The principle is simple: Say what you know, admit what you don’t yet know and come back as soon as you know more.
Aligning On Accountability
As an industry, we need to agree on what accountability looks like and stop pretending breaches don’t happen. At a minimum, every firm should commit to acknowledging breaches within hours, keeping open lines with key partners and providing continuous updates until the picture is complete.
Holding providers accountable starts before anything goes wrong. These are the questions I’d ask any technology provider handling your data before a breach occurs:
1. If something goes wrong, when will I first hear from you? Not when the investigation is finished, but when you first tell me there is a problem, followed by regular updates as the picture becomes clearer.
2. What exactly will you tell me? Telling me it has been fixed is not enough. I want to know what was taken, how it happened, what has changed and whether it could happen again. Above all, I want to know what the stolen information now allows someone to do.
3. If I ask whether my data was affected, can you give me a straight answer? When one of our clients had a messaging account phished, we pulled the IP addresses that had accessed their account with us, traced what had happened and gave them a clear answer. That is the standard I expect.
4. How are passwords, API keys and other secrets protected? Sensitive credentials should be protected through appropriate key-management systems, with access tightly restricted and unnecessary exposure in application memory minimized. Ask whether keys are protected by dedicated key-management hardware or an equivalent, and who has access.
5. If someone gets into one client’s account, can they reach anyone else’s? Each client’s data and credentials should be kept separate, and logins, credentials, trading and client-facing services should be walled off from one another, so that if one area is compromised, the damage stops there.
6. What can someone do with a stolen key, login or access token? Credentials do get stolen. What matters is how much access they provide, how long it stays valid, whether its use would be detected and whether connections are restricted to approved IP addresses. Stolen customer read-only keys should not allow the attacker to access funds or other clients’ information.
Why Openness Is The Best Defense
When I first came into this industry in 2017, what attracted me was its openness and the competitive energy that came with it. Today, that openness matters more than ever. As cyberattacks become more sophisticated and easier to carry out, breaches will keep happening, and no firm can promise they won’t. What every firm can promise is to communicate honestly and quickly when they do.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?