41.8% of breaches affecting leading fintech companies originated with a third-party vendor, according to SecurityScorecard's May 2025 report analyzing the cybersecurity posture of 250 of the world's top fintech companies. That vendor-risk concentration sits alongside rising breach costs and a fintech sector where consumer comfort keeps climbing even as broader data-privacy anxiety stays high.
Below is how vendor risk drives fintech breaches, what those breaches now cost, how consumers actually feel about sharing financial data, and which compliance framework governs a given fintech.
How much of fintech's breach risk comes from vendors?
41.8% of breaches hitting the 250 leading fintech companies SecurityScorecard analyzed in 2025 traced back to a third-party vendor rather than the fintech's own systems. Technology products and services specifically, file transfer software and cloud platforms most often, were linked to 63.9% of those vendor-caused breaches, making a narrow category of shared infrastructure responsible for the majority of third-party exposure.
That concentration mirrors a pattern seen across regulated industries generally, where a single missing control produces most of a sector's enforcement exposure; see 21 HIPAA Settlements in 2025: Fines and Case Data for how the equivalent gap, an undocumented risk analysis, drives roughly 90% of healthcare's own enforcement actions.
AI-driven attack techniques are also becoming a measurable share of the picture rather than a future risk. Roughly one in six financial sector breaches now involves an AI-driven technique, according to IBM's 2026 breach cost research, with deepfake-enabled fraud specifically targeting know-your-customer verification processes.
Figure 1: Share of financial sector breaches involving an AI-driven attack technique, 2026. Source: IBM Cost of a Data Breach Report 2026.
How much does a fintech data breach cost?
A financial services breach cost $6.29 million on average in 2026, up 13% from $5.56 million in 2025, according to IBM's Cost of a Data Breach Report series. That follows a dip the year before, from $6.08 million in 2024 down to $5.56 million in 2025, making financial services one of the more volatile industries in IBM's cost tracking rather than one moving in a single steady direction.
Figure 2: Average financial services data breach cost, 2024 to 2026. Source: IBM Cost of a Data Breach Report, 2024, 2025, and 2026 editions.
Ransomware compounds that cost specifically at financial firms: 59% of financial services organizations hit by ransomware in the past year reported their data was successfully encrypted, above the roughly 50% cross-industry average, according to Sophos's State of Ransomware in Financial Services 2025 report.
Do consumers trust fintech companies with their data?
Consumer comfort with fintech has nearly closed the gap with traditional banks. 84% of consumers are comfortable opening a fintech account, up five points from 2023, compared with 86% comfort for big banks and 87% for community banks, according to Plaid's Fintech Effect 2025 report, based on a Harris Poll survey of more than 2,000 US consumers. Seventy percent of consumers say they feel comfortable sharing information with the digital tools they use, rising to 77% among Millennials specifically.
Figure 3: Consumer comfort opening a financial account, by provider type, 2025. Source: Plaid, The Fintech Effect 2025, Harris Poll survey.
That comfort exists alongside real skepticism about data collection generally: 81% of Americans believe the risks of data collection outweigh its benefits, and 76% of global consumers say they would stop doing business with a company they do not trust to protect their data, according to the same research. Fintechs are, in effect, being trusted with sensitive account data by consumers who remain broadly wary of data collection as a practice, a gap that puts a premium on clear, specific privacy disclosures rather than generic boilerplate.
Which privacy law actually governs a fintech company?
Most fintechs handling consumer financial data fall under the Gramm-Leach-Bliley Act's Safeguards Rule, which requires a written information security program and, since a May 2024 rule change, requires non-bank financial institutions to notify the FTC within 30 days of a breach affecting 500 or more consumers.
Figure 4: The compliance path a fintech follows once it collects nonpublic personal financial information. Source: FTC Safeguards Rule summary and 2024 amendments.
Figure 5: Recent fintech privacy and compliance milestones, 2023 to 2026. Source: FTC; SecurityScorecard; Plaid; IBM.
A written information security program addresses how data is protected, but it does not replace the separate obligation to disclose data practices to users. Fintechs still need a privacy policy that documents what financial data is collected, how it is shared with vendors and data aggregators, and what happens after a breach.
The Bottom Line
Fintech's biggest privacy exposure in 2026 is not the company itself so much as the vendors it depends on: 41.8% of breaches at leading fintechs trace back to a third party, and a narrow category of shared technology infrastructure accounts for the bulk of that exposure. Consumer comfort with fintech has nearly caught up to traditional banking, but that trust is fragile against a backdrop where most Americans remain skeptical of data collection generally. Vendor risk management and clear disclosure now matter as much as a fintech's own security posture, and that documentation gap is not unique to large fintechs; see 64% of Small Firms Document Privacy Policies: 2026 Data for how the same shortfall plays out at smaller financial and professional-services businesses. The next post in this cluster, 130M US Accounts Linked: 2026 Open Banking Data, covers the data-sharing infrastructure that connects fintechs to consumer bank accounts in the first place.
Frequently Asked Questions
What share of fintech breaches trace back to a third-party vendor? 41.8%, according to SecurityScorecard's May 2025 report analyzing the cybersecurity posture of 250 of the world's top fintech companies. Technology products and services specifically, such as file transfer software and cloud platforms, were linked to 63.9% of those third-party breaches.
How much does a financial services data breach cost in 2026? $6.29 million on average, up 13% from $5.56 million in 2025, according to IBM's Cost of a Data Breach Report 2026. Financial services ranks as the second-costliest industry after healthcare.
Do consumers trust fintech apps with their financial data? Comfort is close to parity with traditional banks. 84% of consumers are comfortable opening a fintech account, up five points from 2023, compared with 86% for big banks and 87% for community banks, according to Plaid's Fintech Effect 2025 report, based on a Harris Poll survey of more than 2,000 US consumers.
Does GLBA's Safeguards Rule apply to fintech companies? Yes, if the fintech qualifies as a financial institution handling nonpublic personal information, which covers most lending, payment, and account-aggregation apps. The Safeguards Rule requires a written information security program, and since May 2024 also requires non-bank financial institutions to notify the FTC of breaches affecting 500 or more consumers within 30 days.
Where the Numbers Come From
- SecurityScorecard. (2025). "Defending the Financial Supply Chain: Strengths and Vulnerabilities in Top Fintech Companies." Analysis of 250 leading fintech companies, published May 21, 2025.
- IBM Newsroom. (2026). "IBM Study: One in Four Malicious Breaches are AI-Enabled." Cost of a Data Breach Report 2026, published July 29, 2026.
- Plaid. (2025). "The Fintech Effect 2025." Consumer survey conducted with The Harris Poll, more than 2,000 US consumers.
- Sophos. (2025). "The State of Ransomware in Financial Services 2025." Survey of 369 financial services IT and cybersecurity leaders.
Note: All figures verified as of September 2026. IBM's Cost of a Data Breach figures are drawn from studies covering different 12-month windows each year, so year-over-year comparisons reflect overlapping but not identical survey periods. This post's figures are refreshed at least twice a year to track newer report editions.
