Wall Street Teams Up to Help Save Client Data in Cyber Attack

(Bloomberg) -- On Wall Street, backing up data now comes with a code name.

Nearly three dozen banks are leading a group called Sheltered Harbor that's designed to protect consumers' access to their data in the event a financial institution is hacked. Banks, credit unions and brokerages representing 400 million accounts -- or 70 percent of U.S. retail accounts and 60 percent of U.S. brokerage accounts -- have signed up to be part of the effort, which went live earlier this year.

Sheltered Harbor requires members to encrypt their customer account data and store it in a vault that is both survivable and accessible in case of a cybersecurity incident, according to the group's website. If a breach does occur, the affected bank must retrieve and transmit its data to another financial institution, which can load it onto its core platform. That way customers of the hacked bank can still access their account information.

“The focus is on really trying to protect the consumers' access to their assets,” Steve Silberstein, chief executive officer of Sheltered Harbor, said in a telephone interview. “We have to continue to make the system safer, and it continues to require some amount of sharing and some amount of cooperation to do that.”

For large global banks, it costs $50,000 to participate in Sheltered Harbor, which helps the firms coordinate responses to a cyber attack. For everyone else, fees are based on the amount of assets each one has and can range from $250 to $25,000, according to the group's website.

The group was formed in November 2016 and its recent progress was reported Sunday by The Wall Street Journal.

Hamilton Series

Sheltered Harbor is a subsidiary of the Financial Services Information Sharing and Analysis Center -- or FS-ISAC. Phil Venables, chief operational risk officer at Goldman Sachs Group Inc., and James Rosenthal, former chief operating officer at Morgan Stanley, are co-chairs of the project, according to a press release from FS-ISAC.

The group was formed after banks participated in an exercise in 2015 that was run by FS-ISAC and the U.S. Treasury Department called the Hamilton Series. The exercise exposed how data breaches could hurt consumer confidence in the financial system, even if the incident occurred at a regional or community bank.

Sheltered Harbor does not hold any of the bank account data. Instead, it has created the standards for joining the group and monitors banks' adherence to those standards, said Silberstein, who was previously the chief technology officer at Sungard Data Systems Inc.

To contact the reporter on this story: Jenny Surane in New York at jsurane4@bloomberg.net.

To contact the editors responsible for this story: Michael J. Moore at mmoore55@bloomberg.net, Dan Reichl

©2017 Bloomberg L.P.