Playbook 5
Ransomware & data-theft extortion on the office
The Pathstone pattern: the office's own systems — or its wealth platform — are encrypted or exfiltrated, and the extortion leverage is the family's privacy, not operational downtime.
The hard truth
For a family office the data is the crown jewel. The breach turns the family's privacy itself into the ransom.
The first hour
- 1
Contain: isolate affected systems with your outsourced-IT reality in mind.
- 2
Preserve evidence and logs before wiping or rebuilding anything.
- 3
Engage your cyber insurer early — many policies require it before you act.
- 4
Work the pay/don't-pay decision with privacy as the asset at stake, not just uptime.
- 5
Notify custodians and counterparties whose data may be involved.
- 6
Plan family communication: what do we tell the principals, and when — phone first.
Stop the next one
- Tested, offline backups of office systems and documents.
- Vendor oversight of the wealth platform and bill-pay provider (SOC 2 on file).
- An incident-response plan pre-built for the office's actual stack.
- A family-privacy extortion runbook staged before it's needed.