In-depth guide · Security
Cyber incident response plan: what to do when a family office is attacked
Updated: · Leutrim Miftaraj, FLIORE · Editorial standards · Other languages: Deutsch · Français · Español
Short answer
A cyber incident response plan sets out in advance who decides during an attack, which steps follow in the first hour, how banks, the family and authorities are informed and how systems are restored safely. It follows the phases of preparation, detection, containment, eradication, recovery and lessons learned. Duties to report data breaches exist under the Swiss FADP and, within 72 hours, under the GDPR.
Why family offices are a target
Family offices combine large fortunes, confidential information and small IT teams. Attackers know this: they try to divert payments, take over email accounts, encrypt data or steal confidential documents. An attack cannot be ruled out entirely – what matters is how quickly and how orderly the response is. Without a plan, valuable time is lost in the first hour, and traces are destroyed.
The phases of an incident
| Phase | Aim | Typical measures |
|---|---|---|
| Preparation | Be able to act before anything happens | Response plan, contact list, backups, exercises, insurance |
| Detection and analysis | Confirm the incident and assess its extent | Collect indications, identify affected systems and accounts |
| Containment | Stop the spread | Lock accounts, isolate devices, stop payments |
| Eradication and recovery | Remove the attacker, resume operations safely | Renew passwords, restore systems from clean backups |
| Lessons learned | Learn and improve | Root-cause analysis, action plan, documentation |
The first hour
- Inform the people responsible for emergencies and clarify who has authority to decide.
- Lock affected accounts or change passwords, disconnect affected devices from the network – do not switch them off, so that traces are preserved.
- In case of possible payment fraud, call all banks immediately and have payments stopped or recalled.
- Bring in the IT service provider or incident response specialists.
- Start a timeline: what happened, when, who noticed, which measures were taken.
- Inform the cyber insurer, if there is one – many policies require immediate notification.
Notification duties
Where a breach of data security is likely to result in a high risk for the persons concerned, the Swiss Federal Act on Data Protection requires notification to the Federal Data Protection and Information Commissioner as soon as possible (Art. 24 FADP). Under the GDPR, a personal data breach must be notified to the supervisory authority where feasible within 72 hours if it is likely to result in a risk (Art. 33); where the risk is high, the persons concerned must also be informed (Art. 34). In Switzerland, since 1 April 2025 there has also been a duty to report cyber attacks to the Federal Office for Cybersecurity – but only for operators of critical infrastructure, which family offices generally are not. A criminal complaint to the police is advisable in cases of fraud and extortion.
Worked example (simplified)
An employee notices forwarding rules in her mailbox that she does not recognise. Following the response plan, she informs management immediately; the account is locked and the IT service provider checks the sign-ins and finds an access from abroad. Because the attacker could see invoices with bank details, all banks are warned and the past week's payments are checked – one to a changed IBAN can still be stopped. Since the family's client data was visible, the family office examines the notification duty and reports the incident to the competent data protection authority.
Preparation that pays off
- Two-factor sign-in for all accounts, especially email and banking.
- Backups following the 3-2-1 rule: three copies, two media, one off-site and disconnected from the network; test restoration regularly.
- A contact list available offline: banks, IT, insurer, lawyer, data protection authority, police.
- An annual tabletop exercise with a realistic scenario.
- A clear rule: never execute payments or account changes solely on an instruction by email.
Communication in an emergency
Besides the technical response, communication decides the extent of the damage. The family must be informed quickly and honestly, without speculation; banks need clear instructions on which payments to stop or check especially carefully; staff need a rule on what they may tell outsiders. A single person is responsible for enquiries from media or business partners.
The channels must be secure: if email accounts are compromised, instructions must not run through them – telephone numbers agreed in advance or a separate channel are needed. After the incident, a short report to the family and governing bodies follows: what happened, which data was affected, which notifications were made and which measures prevent a repetition. Openness strengthens trust more than any reassuring wording.
In FLIORE
FLIORE supports preparation with two-factor sign-in that can be enforced across the organisation, role-based rights, encrypted document storage, four-eyes approvals for payments and an audit trail that shows in an emergency who accessed which data and when.
At a glance
| Phases | Preparation, detection, containment, eradication/recovery, lessons learned |
|---|---|
| Notification in Switzerland | FDPIC as soon as possible where a high risk is likely (Art. 24 FADP) |
| Notification in the EU | Supervisory authority where feasible within 72 hours (Art. 33 GDPR) |
Terms on this page
- Audit trail
- An unalterable log that records who created, changed, approved or deleted which data and when.
Frequently asked questions
Must every cyber incident be reported?
No. Breaches of data security likely to result in a high risk (Switzerland) or a risk to the persons concerned (EU) must be reported. The assessment and its result should be documented.
Should affected devices be switched off?
It is better to disconnect them from the network and leave them switched on, so that traces are preserved for the analysis – unless specialists advise otherwise.
Should a ransom be paid?
Authorities advise against it, because it encourages further attacks and offers no certainty of recovery. Clean, separate backups are what matter.
Who should be on the emergency team?
The head of the family office, the person responsible for IT or the service provider, compliance or data protection, and one person for communication with the family and banks.
How often should the plan be practised?
At least annually as a tabletop exercise with a realistic scenario, and additionally after major changes to the IT.
Does cyber insurance help?
It can cover the costs of specialists, recovery and liability. The conditions matter, such as notification deadlines and minimum security requirements.
How is the family informed?
Quickly, factually and through a secure channel: what is known, what is being done and when the next update follows. Speculation about causes or perpetrators should be avoided until the analysis is available.
Which documents should be available offline?
The emergency contact list, the response plan itself, access data for recovery in a secured safe and the most important contract numbers, such as that of the cyber insurance.
What role does the IT service provider play?
It is usually the first technical point of contact. The contract should set out how quickly it responds in an emergency, who has access to logs and whether it brings in incident response specialists. These questions belong before the emergency.
Sources
- NIST SP 800-61 – Computer Security Incident Handling Guide
- Swiss Federal Office for Cybersecurity (NCSC/BACS)
- German Federal Office for Information Security (BSI)
- Federal Data Protection and Information Commissioner (FDPIC)
- Swiss Federal Act on Data Protection (FADP, SR 235.1) – Fedlex
- General Data Protection Regulation (EU) 2016/679 – EUR-Lex
This page provides orientation and does not replace legal or tax advice. The cited legal sources in their applicable version are authoritative.
Read more
More on Operations, security & technology
FLIORE in your family office
See structures, compliance and consolidated wealth with your own questions – in a personal demo.