We provide an economic analysis of how data redundancies via multiple and partial backups as well as data segmentation affect private and socially optimal investment in data security against cyber attacks. Redundancies cause free-riding so that in equilibrium overall data security against cyber attacks is below socially optimal levels. A financial market infrastructure that observes all of the data can choose its data security level to improve upon the private outcome, but cannot induce a response from the private banks that generates the socially optimum level of security. Regulation is required to obtain a social optimum.