How financial advisers can prevent cyber breaches

cyber breach law cybersecurity

21 November 2022
| By Jasmine Siljic |
expand image

A specialist cybersecurity lawyer has shared six tips for advisers to mitigate the risk of attacks, following evolving updates from the Optus and Medibank data breaches.  

Katherine Jones, partner at Colin Biggers and Paisley Lawyers, had managed over 500 cyber breaches during her litigation career in handling cybercrime and fraud.

In partnership with the Association of Financial Advisers (AFA), Jones discussed how firms could be proactive against cyber crime and what to do in the event of a breach. 

Financial advisers fell under the category of 'critical infrastructure', according to the Australian Cyber Security Centre. Past cases of cyber crime demonstrated these types of organisations, alongside government bodies, were at a higher risk of online breaches. 

With cyber attacks costing Australians close to $29 billion each year and 75% of cyber crimes resulting in a loss of funds or data, the partner reiterated the importance of having adequate risk management. 

She examined four common types of cyber breaches:

  • Malware, which is designed to cause harm to computer systems. This included trojans, worms, spyware and ransomware;
  • Phishing, when a cyber criminal sends out fake emails to steal the login details of an employee. For phishing to be successful, it needed to come from someone that you would expect to receive an email from;
  • Stolen details, evident in both the latest Medibank and Optus data breaches. This occured when an individual’s credentials were compromised, which made up 19% of all cyber breaches; and 
  • Business email compromise, which Jones described as “the most upsetting” form of breach. This targeted an employee’s email and left them vulnerable to surveillance, particularly those making authorised payments who were at a higher risk.

The Colin Biggers and Paisley partner identified six ways financial advisers could manage their risk and questions they should ask:

People and staff:

  • How adequately are your employees trained?
  • Are there email simulations internally?
  • Do your employees know who to contact if they receive something suspicious?
  • Is there a culture of calling to verify details internally?
  • Jones advised financial advisers to change their passwords monthly to mitigate the risk of a cyber threat.

Secure network:

  • How up-to-date are the systems that you are running?
  • How does your organisation store back-ups?
  • Do you use an external company for penetration testing?
  • Use multi-factor authentication on automatic logins.
  • Cloud-based software will increase your chance of a breach by 45%.


  • Who is authorised to make large payments?
  • Do you call to verify payments?
  • Jones advised the advantages of outsourcing and processing payments through a third-party to increase security.


  • Do you need insurance and what does it cover?

Email risk:

  • Phishing simulations enable employees to suspect strange emails.
  • Frequent password changes additionally prevents the threat of stolen credentials. 

Cyber event:

  • What is your plan if a cyber event were to occur? 
  • Is there an escalation process and policy to prevent paying ransoms?
Read more about:


Add new comment

The content of this field is kept private and will not be shown publicly.

Recommended for you

sub-bgsidebar subscription

Never miss the latest news and developments in wealth management industry



One foot out the door

A financial planner is expected to earn between $95,000 and $120,000 per year, depending on the state. Really? I don't...

9 hours 39 minutes ago

The whole thing is a bit frightening especially the last note where notes on what might be done could result in the need...

1 day 6 hours ago

Well done Keith and Neil, these Canberra Bureaucrats need to be stopped. ...

5 days 2 hours ago

ASIC has cancelled the AFS licence of a Sydney wealth firm, the fifth Sydney firm to see a cancellation since the start of the year....

1 week 6 days ago

A former financial adviser has been banned by ASIC from providing financial services for inappropriate advice, among multiple breaches....

4 weeks ago

More than 20 winners from the funds management industry have been crowned at this year’s awards....

6 days 8 hours ago