Financial services firms account for more data breaches than any other sector, according to a new report which warns that third-party suppliers are increasingly becoming the weak link in cyber security.
Research by global financial and risk advisory firm Kroll found financial services made up 20% of organisations breached between June 2025 and June 2026, putting the sector ahead of professional services and healthcare.
For the Channel Islands’ finance industry, the findings are a reminder that the biggest cyber threat may not be inside the business itself, but somewhere in its supply chain.
Ed Shorrock, co-managing director of Kroll’s Jersey office, said the findings should strike a chord across the Channel Islands.
“The fact that the financial services continues to be the sector experiencing the most breaches at a global level should resonate clearly in Jersey and Guernsey.”
“Across most of the major incidents Kroll handled over the past year, a vendor, software supplier or service provider was the link between the initial breach and the organisations affected.”
Repeat victims
The report suggests cyber incidents are becoming an increasingly regular occurrence rather than one-off events.
Almost seven in 10 organisations surveyed said they had suffered a data breach in the previous year, while more than a third reported being breached more than once.
The findings are based on incidents handled by Kroll’s Cyber and Data Resilience team and a survey of 250 business leaders, risk professionals and board members.
The third-party problem
While financial services recorded the highest number of breached organisations, third-party attacks were responsible for most of the wider fallout.
According to the report, 69% of affected individuals were impacted through a third-party breach, highlighting how a single supplier can create problems for hundreds of connected businesses.
Technology companies ranked only seventh by number of organisations breached, but first when it came to the number of people affected.
Kroll found 79% of individuals caught up in third-party breaches were affected by incidents originating in the technology sector, compared with 9% linked to finance and 6% to insurance.
The study also found IT teams appear far more concerned about supplier risk than senior executives. More than half of technology leaders rated vendor breaches as their biggest compliance risk, compared with fewer than a third of risk and compliance leaders.
AI adds new risk
Looking ahead, Kroll expects artificial intelligence to feature more prominently in future cyber incidents.
Malin Nilsson, co-managing director of Kroll’s Jersey office, said businesses would need to pay closer attention to who and what can access sensitive systems.
“As AI agents are given more access to systems and sensitive data, breach risk rises across both human and non-human identities.”
“Data and identity governance are becoming even more complex, and we expect AI to feature more prominently in Kroll’s Data Breach Outlook next year, both as a tool used by attackers and as a source of exposure for businesses adopting it.”
Kroll said organisations that map their supplier relationships and establish response plans before an incident occurs are typically better placed to limit both the disruption and cost of a breach.
