Financial institutions facing more cybersecurity, data privacy disputes

Financial institutions' exposure to cybersecurity and data privacy disputes has deepened so far this year, according to Norton Rose Fulbright’s annual litigation trends survey. .More than half of financial institutions experienced greater federal exposure to disputes in cybersecurity, data privacy and consumer protection. Forty-seven percent listed heightened exposure to AI disputes. FIs listed data breaches or cybersecurity incidents as their most-cited class action trigger so far this year at 56 percent. According to CrowdStrike, attacks from AI-enabled adversaries increased 89 percent on an annualized basis last year amid the use of large language models to automate and scale. Cybersecurity and data privacy were the top areas of increased dispute exposure, according to the poll of 135 general counsel and in-house litigation leaders in the financial industry and energy, health care and technology sectors.Fifty-six percent reported more risk federally, while 53 percent cited heightened risk at the state level. Those numbers outpace the cybersecurity and data privacy exposure executives expected to face this year. Late last year, only 29 percent expected to face heightened cybersecurity and data privacy exposure in 2026. Forty-six percent reported more federal dispute exposure on artificial intelligence, with 42 percent seeing state-level increases. Employment and labor risk remained pressing, with 39 percent citing heightened federal dispute exposure and 44 percent seeing greater risk exposure at the state level. More than half cited data or cybersecurity breaches as a likely cause of such issues, while 47 percent listed workforce changes. Forty-one percent of respondents cited product launches or AI-related deployments as a likely cause. Despite the heightened risk exposure, 71 percent said managing outside counsel expenses had become easier or stayed the same. “What stands out is how quickly the litigation environment is evolving, especially around cybersecurity incidents, consumer claims and AI-related disputes,” said Steven Jansma, U.S. head of litigation and disputes at Norton Rose Fulbright. “We are seeing new approaches and a level of activity that is accelerating across industries. Even where federal enforcement has softened, states are often stepping in and pushing litigation forward.”