A version of this article first appeared in CNBC’s Inside Wealth newsletter with Robert Frank, a weekly guide to the high net worth investor and consumer. Sign up to receive future editions straight to your inbox.

Family offices are increasingly under attack from cybercriminals, and many lack the staff or technology to adequately prepare, according to a new survey.

More than three-quarters, 79%, of North American family offices say the likelihood of a cyberattack “has increased dramatically in the past few years,” according to a survey of single-family offices by Dentons, a global law firm. A quarter of family offices surveyed reported suffering a cyberattack in 2023, up from 17% in 2020. Additionally, half say they know another family office that has suffered a cyberattack, according to the survey.

With their substantial wealth and relatively small staffs, family offices have become lucrative targets for hackers and cybercriminals, experts say.

“It’s the Willie Sutton effect,” said Edward Marshall, global head of family office and high net worth at Dentons, referring to the famous bank robber who targeted banks “because that’s where the money is.”

Marshall explained that family offices often have minimal staff with access to highly sensitive information about a wealthy family’s finances and private companies. Since family offices prioritize efficiency and speed over risk management, they frequently lack the adequate technology and planning needed to fend off cyberattacks.

“Family offices often have a bias toward efficient service versus security,” he said.

Using in-house security teams can be expensive for family offices, he added, while using third-party vendors and suppliers also creates risks from “sophisticated criminals and bad actors.”

Despite the growing fears of cyberattacks, these concerns have not yet translated into better defenses. Less than a third of family offices say their cyber risk management processes are well-developed, according to the survey. Only 29% say their staff and cyber-training programs are “sufficient,” and less than half have upgraded staff training programs or regularly update cyber policies.

“These findings reveal an alarming gap between awareness of cybersecurity risks and the actions put in place to prevent and repel attacks,” the report said.

A separate report from EY U.S. and the Wharton Global Family Alliance advises family offices to tackle cybersecurity by addressing each of the three main components of tech risk: hardware, software, and applications.

Instead of sending emails with financial or personal information, the report recommends that family offices use a website or intranet site. It also suggests the use of password vaults and better vetting of tech vendors for security.

Marshall emphasized that family offices need to adopt a more proactive stance on overall assessment that goes beyond cyberattacks.

“They need a mind shift from accepting the unexpected to expecting the unexpected,” he said.

The vulnerability of family offices to cyber threats is exacerbated by their high-value targets and often minimal security infrastructure. Hackers can exploit the lack of robust cybersecurity measures to gain access to sensitive financial data, personal information, and proprietary business details. The ramifications of such breaches can be severe, leading to financial losses, reputational damage, and legal complications.

The survey by Dentons highlights a critical need for family offices to enhance their cybersecurity frameworks. This includes investing in advanced cybersecurity technologies, conducting regular security audits, and fostering a culture of security awareness among staff. Training programs should be comprehensive and ongoing, ensuring that employees are well-versed in recognizing and responding to cyber threats.

Furthermore, family offices should implement multi-factor authentication (MFA) for all sensitive accounts and employ end-to-end encryption for communications. Regular updates and patches for software and systems are also crucial to mitigate vulnerabilities.

The use of managed security service providers (MSSPs) can offer an additional layer of protection. These providers offer specialized cybersecurity services, including threat detection, incident response, and continuous monitoring, which can be particularly beneficial for family offices with limited in-house security expertise.

In addition to technological measures, family offices must develop robust incident response plans. These plans should outline clear procedures for identifying, containing, and mitigating cyber incidents. Regular drills and simulations can help ensure that all team members are prepared to act swiftly and effectively in the event of a breach.

Ultimately, the evolving cyber threat landscape requires family offices to stay vigilant and proactive. By adopting a holistic approach to cybersecurity, they can protect their valuable assets and maintain the trust and confidence of their clients.