Cyber incidents as reputational events

The breach is the story for a day. The response is the story for years.

Boards now treat cyber risk as a reputation issue as well as a technical one. In the 2026 Reputational Risk Readiness Survey by WTW, the global risk advisory and insurance broking firm, 67% of 500 senior executives across 20 countries ranked cyber-attacks among their greatest reputational concerns. Respondents are also budgeting for prolonged crises, which suggests they expect the damage to outlast the incident.

How an organisation responds usually matters more to its reputation than the breach itself: how quickly it discloses, whether its early statements hold up and whether its first account survives what comes out later. The cases below illustrate this.

Revolut: a fraudulent request from a trusted source

In September 2026, Revolut, the London-based fintech with more than 80 million customers worldwide, confirmed that it had disclosed customer data to a third party impersonating a government agency. The requests came from a legitimate government email domain and passed the bank’s authentication checks. Revolut said its systems and customer funds were unaffected, and that it had blocked the address and alerted the agency, law enforcement and regulators.

Revolut’s public statements addressed the security of its systems and funds. The notices sent to affected customers covered different ground, listing identity documents, verification selfies, account statements and full transaction histories among the data involved. Revolut described the number affected as “limited” and did not name the agency. The reported figure of around 680 customers came from media sources rather than the company.

This is a common challenge when no system has been breached. The most accurate statement – that systems and funds are safe – is not always the one affected customers most need, as their first concern is usually their personal documents. For a company reportedly preparing for a public listing, investors will also be following how the incident is handled.

M&S: a ransomware attack on a household name

When Marks & Spencer, one of Britain’s best-known high street retailers, was hit by ransomware over Easter 2025, its communications were widely praised. The chief executive fronted the response and updates were regular.

Polling still showed a sharp dip. The Harris Poll, a market research firm, found M&S’s reputation broadly intact at the height of the crisis in May. By the summer, M&S had fallen from fifth to 51st in Harris’s UK corporate reputation rankings, with the theft of personal data a particular concern. By November, polling by the data and analytics company GlobalData ranked it the UK’s most trusted retailer. Long-standing trust appears to have given M&S room to recover. It did not prevent the damage, and few organisations can draw on reserves of that depth.

ASOS: a breach announced by the attackers

ASOS, the UK-based online fashion retailer with around 17 million customers, faced the most exposed version of this test. On the morning of 6 October 2026, its app users received a push notification headed “ASOS HACKED”. The message was sent through the ASOS app, via a third-party platform the company uses to communicate with customers, addressed to its data protection officer and threatened to leak customer data. Customers heard about the breach from the attackers before they heard from the company. ASOS shares fell by more than 10% that morning.

ASOS confirmed the unauthorised notification the same day and said names and contact details may have been accessed. Its fuller statement reportedly came around five hours after the alert. Two days later, a fuller picture emerged. The data included addresses, phone numbers, dates of birth, customer numbers and search histories, reportedly affecting potentially millions of customers.

The attackers got in by deceiving a member of staff. ASOS says they gained access to an employee account by impersonating a trusted contact, then used those credentials to reach data held on third-party platforms.

The investigation is ongoing. Two points stand out so far. Once attackers have sent the first message, anything the company says is a reaction, and a delay of several hours feels long to worried customers. And, as at Revolut, the first public account was narrower than the full picture that later emerged.

Family offices and high-profile individuals

A breach at a retailer or a bank is mainly a business problem. For a family office or a high-profile individual, the stolen data can be damaging in itself: home addresses, children’s schools, travel patterns, asset holdings and identity documents. It creates a personal security risk as well as a reputational one. Smaller teams, often without trained spokespeople, also have less capacity to respond in the first hours, when public perception takes shape.

In both the Revolut and ASOS cases, the attackers posed as someone the organisation had good reason to trust. Any organisation that responds to apparently official or familiar requests faces the same risk, including private banks, wealth managers, family offices and their advisers.

Fideuram, the private banking arm of Intesa Sanpaolo, Italy’s largest bank, was hit by a more elaborate version of the same approach. The fraud took place in February 2026 but became public only in September 2026, when Italian media reported it. Its chairman received a WhatsApp message apparently from the group’s chief executive. A call followed from what sounded like a senior partner at a prominent law firm, which reports say was an AI-cloned voice. Around €95 million was transferred abroad before the fraud was detected, and roughly €36 million remains unrecovered. No system was breached. The scheme relied on a senior name, a confidential deal and time pressure – conditions family offices and their advisers deal with every day.

AI voice cloning has been used this way before. In 2025, fraudsters used AI to impersonate Italy’s Defence Minister, Guido Crosetto, and targeted prominent business figures including fashion designer Giorgio Armani and Prada co-founder Patrizio Bertelli. Recognising a voice on the phone is no longer enough to confirm who is calling. A call-back or second-channel check for any urgent or confidential instruction, however senior its apparent source, is now a basic safeguard.

Strictly speaking, several of these cases are fraud carried out online rather than cyber-attacks. Clients, the press and regulators are unlikely to draw that distinction. They tend to see both as security failures.

Preparing before an incident

Organisations that handle these moments well have usually settled four things before an incident occurs:

• Decision rights. Agree in advance who decides what is disclosed and when, with legal, IT and communications working as one team.
• Holding statements. Keep short, legally cleared drafts ready, so first statements are prompt and accurate.
• Careful early figures. State what is known, what is not and when the next update will follow. Avoid figures that may later need to be revised.
• A plan for affected individuals. Tell them what was taken, what it means for them and what to do next. Saying that funds or systems are safe does not cover this.

No organisation can remove cyber risk entirely. What it can control is whether its first 72 hours of communication still look sound three months later. Decide now who speaks, what they say and who is allowed to say “we don’t know yet”.

GRA advises boards, family offices and high-profile individuals on crisis preparedness and response worldwide. To discuss your organisation’s readiness, get in touch with our team: [email protected].