AI, Cyberattacks and Data Protection: The New Security Reality

Jekaterina Anohina, Senior Lawyer & Data Protection Officer at Wandoo Finance

Financial companies handle some of the most sensitive information about their customers - from personal and identity data to financial information and transaction history. As financial services become increasingly digital, protecting this data is becoming more complex. At the same time, cyberattacks are evolving, the transition to post-quantum cryptography is becoming more urgent, and artificial intelligence is creating both new security tools and new risks.

How has the cybersecurity and data-protection landscape changed for financial companies in the Baltics over the past few years?

To a large extent, the cybersecurity and data-protection landscape in the Baltics has evolved in line with the rest of Europe. However, the region’s proximity to current geopolitical tensions brings additional considerations for companies operating in the Baltics. This means that companies across many sectors, including finance, need to account for geopolitical volatility in their cybersecurity and personal data protection strategies and risk management. The landscape has also been shaped by evolving EU regulation, including digital operational resilience, cybersecurity, and AI, alongside broader European trends in threats, threat actors, and attack techniques. These developments add to the challenges financial institutions face, which have long been particularly attractive targets compared with companies in many other sectors, given the sensitivity and value of the information they handle.

Does the threat level differ for global companies working across many markets?

Operating across several markets adds complexity because customer expectations, regulatory requirements, external providers and operational processes may differ from one country to another. At the same time, cybersecurity and data protection cannot be managed as isolated local matters. A weakness in one part of the organization can create consequences elsewhere.

Our approach is therefore to establish common principles and minimum requirements across the business while allowing local processes to reflect the applicable legal and operational environment. This creates a consistent level of protection without assuming that precisely the same solution will work in every market. It also allows lessons identified in one country to be applied across the wider organization.

What types of cyberattacks currently pose the greatest risk to fintech and consumer finance companies? How significant is the risk of customer data being compromised?

I would highlight social engineering as a major threat. While it has been prominent for some time, the way these attacks are carried out is evolving. Criminal actors can use generative AI to automate and scale their attempts, produce realistic phishing emails, create deepfake audio and video, and forge more convincing documents. This can make it easier to manipulate individuals into disclosing sensitive information or taking harmful actions, which is the central aim of this type of attack.

Another development worth highlighting is not a cyberattack in itself, but the implications of quantum computing for cryptography. Sufficiently advanced quantum computers could undermine certain cryptographic methods currently used to protect information. This raises concerns about the “harvest now, decrypt later” approach, where attackers collect and store encrypted data with the expectation that future technology will enable them to decrypt it. This adds a longer-term dimension to the risk of customer data being compromised - information that is protected today could become readable in the future. Given how heavily companies rely on encryption to protect personal data, these developments need to be considered when assessing whether that protection will remain effective for as long as the information needs to stay confidential.

Could you describe how Wandoo Finance approaches cyber incident preparedness and response? What insights or lessons have been most valuable in developing this approach?

We ensure we have the capabilities to detect, escalate, and manage incidents. Where practical, we also prepare ready-to-use methodologies, templates and playbooks to guide incident classification and subsequent decision-making. This helps us respond efficiently and consistently, even under pressure. One of the most valuable lessons in shaping our approach has been recognizing that preparation is key and communication is essential. Clear processes matter, but so does ensuring everyone involved understands their role and communicates effectively throughout the response.

How does Wandoo Finance identify suspicious activity and maintain operational resilience if a threat develops into an incident?

We rely on a combination of automated monitoring and human reporting. Our monitoring tools generate timely alerts and maintain relevant logs, while employees are trained to recognize and report suspicious activity. Reports from customers, service providers and other external parties can also provide important warning signals.

No organization can assume it will prevent every disruption. We therefore also consider how to maintain critical services and restore systems if an incident occurs. This requires a clear understanding of which systems, datasets and external services are essential to our operations, as well as recovery priorities based on the potential impact on customers and the business. Cyber resilience is therefore not purely an IT responsibility, but a business-wide capability covering detection, response, continuity and recovery. It is an ongoing 24/7 process.

Financial companies collect and process large amounts of sensitive customer information. What are the biggest challenges in ensuring that this data remains secure throughout its lifecycle?

Unlike physical items, digital information is often easier to collect than to dispose of. I would therefore say that deletion is one of the most challenging stages of the data lifecycle. Ideally, it should be carried out gradually as the purposes for retaining the data end. However, the same datasets may be processed for several purposes and therefore be subject to different retention requirements, which makes this more complex. Furthermore, effective deletion requires knowing where the data is held across your systems, including copies and information processed by third-party providers. At the same time, retaining data for longer than necessary may not only breach data-protection requirements but also increase the amount of information potentially exposed in a cyberattack.

How can data protection be incorporated into the development of new financial products?

Data protection is most effective when it is considered while a product or process is being designed, rather than reviewed only before launch. This means understanding what information will be collected, why it is needed, how it will be used, who will have access to it, and how long it should be retained. It also means examining whether the same business objective could be achieved with less data or through a less intrusive process. More data does not automatically produce better decisions. Every additional data point must serve a defined and legitimate purpose, and its collection also creates responsibilities for accuracy, access, retention, and security. Accumulating information simply because it may become useful in the future can increase both compliance exposure and the potential impact of a security incident.

This is particularly relevant when entering a new market, introducing a new lending product or adding a new customer journey. Early involvement from legal, compliance, data-protection and technology specialists makes it easier to identify risks before they become embedded in systems and operating processes. It also reduces the need for costly adjustments later.

How is artificial intelligence changing cybersecurity and data protection? Are attackers becoming more sophisticated because of AI? Are people more cautious, or have AI hackers become too sophisticated to tell the truth from a lie?

AI has a dual-use nature in cybersecurity and personal data protection - it can strengthen both offensive and defensive capabilities. On the one hand, AI systems introduce new targets and attack vectors, while AI tools can increase the scale, speed, and sophistication of cyberattacks. On the other hand, AI can strengthen companies’ ability to detect threats, analyze suspicious activity, and respond to incidents. For individuals, AI can certainly make attacks more convincing and precisely targeted, making it increasingly difficult to distinguish legitimate messages or content from fraudulent ones.

AI is also increasingly being adopted by companies themselves. Does this create new data-protection risks, particularly when employees use generative AI tools that may involve sensitive or confidential information? How do you ensure safe use of such tools?

This is an interesting question because AI is a tool like many others, meaning that it may require appropriate controls to ensure compliant use, but its use is not inherently unsafe or, as a general rule, prohibited. AI is also still relatively new in many business contexts and is technically complex, which means it is not always fully understood. This applies to both the legal framework governing it and how it works in practice. AI certainly introduces new cybersecurity and personal data protection risks, which must be identified and assessed in the context of each company’s operations. At the same time, those risks should be treated proportionately and balanced, allowing businesses and users to benefit from the opportunities AI offers.

In our case, we started by ensuring that our compliance teams understood both the applicable legal framework and the practical aspects of how AI works. This understanding helps us determine which controls (including internal rules and restrictions) are appropriate and why they are needed. It also enables us to translate those requirements into simple, practical guidance for employees and engage in an informed, collaborative dialogue about their use of AI tools.

Financial companies increasingly depend on cloud services, technology providers and other external partners. How do you ensure that customer data remains protected when it passes through or is processed by third parties?

Cooperation with a service provider or partner generally involves three stages: selecting the provider, managing the relationship under the contract, and ending that relationship. We aim to maintain control throughout all three, particularly where a partner processes personal data or supports a critical business function. Before entering into a contract, we assess the provider’s reliability, reputation, and ability to meet our compliance requirements. During the relationship, we ensure that our contracts allow us to reassess the provider and require improvements where necessary. Finally, we ensure that we can terminate the relationship if a partner no longer meets our requirements, particularly regarding personal data protection. We also plan for an orderly exit or transition to an alternative provider, so that our business does not become overly dependent on any particular partner.

Cybersecurity incidents often begin with human error rather than a technical vulnerability. How important is employee awareness in Wandoo Finance’s data-protection and cybersecurity strategy?

I believe people are the strongest link, rather than the weakest, as they are sometimes described. Technology will fail, and mistakes will happen. We cannot eliminate these risks entirely. However, we can build a strong cybersecurity and personal data protection culture that supports responsible employee behavior, while developing the response team’s skills to handle incidents effectively when they arise. This means employees understand what is expected of them, know how to recognize potential problems and escalate them appropriately, and an agile response team is ready to act and manage the situation. For this reason, training, awareness initiatives and practical exercises that strengthen our resilience and ability to respond are essential components of our data-protection and cybersecurity strategy.

Has regulation materially changed how financial institutions approach the protection of customer data?

The financial sector has long been one of the most heavily regulated industries. In recent years, however, regulation has increasingly focused on different aspects of companies’ digital operations. While this introduces new obligations, I would not describe it as a fundamental change in the underlying principles. Rather, the processes and methods for putting those principles into practice are becoming more prescribed. Therefore, while many core requirements have been familiar to financial institutions for a long time, companies now appear to have less flexibility in how they meet certain obligations. This, of course, requires adjustments to their processes, including how they manage personal data protection, cybersecurity, and digital operational resilience.

Finally, what three things should every customer do today to better protect their personal and financial data online?

First, and in my opinion most importantly, build your IT and AI literacy. The better you understand the technologies you use and how they work, the more informed and considered your decisions will be.

Second, practice basic cyber hygiene. Use strong, unique passwords, enable multifactor authentication where available, and keep your devices and applications updated. These everyday habits provide an important foundation for protecting your personal and financial data.

Last but not least, think critically. Social engineering attacks, including phishing, aim to manipulate people into disclosing sensitive information or taking harmful actions. AI can make these attacks increasingly convincing and personalized. One important way to protect yourself is to use a tool you always have at your disposal: your critical thinking. Evaluate the situation, consider the context, and then decide how to act.