Latest / The Pivot Podcast with Fexingo: How Businesses Change Direction and Survive Disruption / How a Bank Rebuilt Trust After a Data Disaster
Transcript
- Lucas: So, earlier this week, I was reading a stat from the 2025 IBM Cost of a Data Breach report, and one number jumped out: it costs financial services firms an average of six point one million dollars per breach. But the cost that doesn't show up on the ledger — the harder one to price — is what happens to customer trust afterward. Luna: And that's the part that can actually break a bank. Not the immediate outlay, but the slow bleed of deposit flight, the reputational drag. Lucas: Exactly. And there's a case from a couple of years ago that I think illustrates this perfectly — and it's a story about a mid-sized bank in the Midwest called Irving National Bank. In early 2023, they suffered a data breach that exposed the personal information of roughly four hundred thousand customers. And the way they handled the aftermath — specifically how they rebuilt trust — is a masterclass in what a business pivot looks like when you're not pivoting your product, but your entire relationship with your customer base. Luna: Yeah, and I think this is a good moment to mention — if these kinds of deep dives into real business decisions are useful to you in your work, we keep this show ad-free, and it's because of listeners who choose to support it at buy me a coffee dot com slash fexingo. No pressure, just wanted to put that out there. Lucas: Absolutely. Appreciate that. So, back to Irving National. The breach happened in February 2023. It wasn't a sophisticated state-actor attack — it was a phishing campaign that compromised an employee's credentials, and then the attackers moved laterally inside the core banking system for about six weeks before being detected. Luna: Six weeks of undetected access inside a bank? That's terrifying. Lucas: It is. And once they were discovered, the bank had to assume that customer names, Social Security numbers, account numbers — basically everything needed for identity theft — had been exfiltrated. Now, here's the pivot. Most banks in that situation would send a boilerplate notification, offer a year of credit monitoring, and hope the story fades. Irving National did something different. Luna: What did they do? Lucas: They went fully transparent. The CEO, a woman named Sarah Olmstead, recorded a video message the same day the breach was confirmed. She didn't sugarcoat it. She said, 'We failed to protect your data, and we are going to tell you exactly what happened and what we're doing about it.' They published a detailed timeline on their website, including the forensic findings, and they offered every affected customer free credit monitoring and identity theft protection for life — not one year, for life. Luna: For life. That's a huge commitment. What did that cost them? Lucas: The financial hit was significant. They spent roughly forty-seven million dollars in total remediation — that includes the lifetime monitoring contracts, legal fees, IT security overhaul, and a full replacement of their core banking software. And then there was the hit to deposits: in the first quarter after the breach, they lost about twenty-two percent of their deposit base. Customers pulled out roughly eight hundred million dollars. Luna: That's the trust bleed I mentioned. But if they lost that much, how did they recover? Lucas: Well, the interesting part is that the outflow stopped after about six months. And then it reversed. By early 2024, deposits had not only returned but were four percent above pre-breach levels. What happened was that the bank's transparency became a competitive differentiator. Local media covered the story heavily, and the narrative shifted from 'bank that got hacked' to 'bank that did right by its customers.' Luna: So they essentially turned a crisis into a brand-building moment. But that only works if the underlying commitment is real. If they had just talked a good game and then cut corners, the trust would never come back. Lucas: Exactly. And they backed up the talk with structural changes. They hired a new chief information security officer from outside the industry — a woman who had been a security architect at Amazon Web Services. They implemented a zero-trust architecture, mandatory phishing simulations for all employees every month — not just once a year — and they gave every customer the ability to freeze their accounts with a single tap in the mobile app. Luna: I want to talk about that lifetime monitoring offer for a second. That's not just a cost — it's a statement. 'We stand behind our failure for as long as you're with us.' Did any other bank do that at the time? Lucas: Not that I'm aware of. Most breach responses follow a standard playbook, and Irving National tore it up. And there's a really interesting data point that came out of their recovery: during the six months when deposits were at their lowest, they actually saw an increase in new account openings from people who weren't affected by the breach. They were opening accounts because they respected how the bank handled it. Luna: That's the paradox. The people who were most personally affected — the depositors — understandably fled. But the general public, who observed the response from a distance, saw integrity. So the bank ended up with a different, potentially more loyal customer base. Lucas: Right. And the lesson for any business facing a trust crisis is that the traditional instinct — control the narrative, minimize liability, wait for it to blow over — is almost always the wrong move. The cost of full transparency is front-loaded, but the cost of half-measures drags on for years. Irving National's deposit recovery happened in eighteen months. The average for a major breach in financial services is closer to three years. Luna: That's a big difference. So what's the one concrete thing a business leader should take away from this case? Lucas: I think it's that trust is not a soft metric — it's a financial asset with a measurable return. Irving National invested forty-seven million dollars to rebuild trust, and they got back a deposit base that was both larger and more engaged than before. If you can calculate the lifetime value of a customer relationship, you can model the ROI of being transparent in a crisis. And in their case, it paid off. Luna: But it also required a leader willing to say 'we failed.' That's rare. Most executives are trained to project confidence, not vulnerability. Lucas: Sarah Olmstead said in an interview later that she felt physically ill before recording that video. But she knew that if she tried to spin it, the trust would never come back. And I think that's the core of the pivot: changing from a mindset of damage control to a mindset of relationship repair. It's not about the data breach; it's about what the data breach reveals about your values. Luna: Yeah. And I think that's a lesson that applies beyond banking. Every business is vulnerable to some kind of failure. The question is whether you've already decided what you'll do when it happens. Lucas: And Irving National's story suggests that having that answer ready — and being willing to pay the short-term price for long-term trust — might be the most important strategic decision you never think about until it's too late. Luna: Well said. Thanks, Lucas. Lucas: Thanks, Luna. That's it for this episode of The Pivot Podcast.