COLLECTED WISDOM™ on Cybersecurity Risks and Liabilities

This is a collection of articles, papers, and commentaries on cybersecurity risks and liabilities for employers, retirement plan sponsors and fiduciaries.

This archive contains not only the most current material on the topic, but also older items that are still relevant, provide background, perspective or are germane to the topic.

If you find a broken link or an items that you feel is outdate, irrelevant or no longer appropriate, please let us know.

Fiduciary Duty in the Digital Age: Cybersecurity Best Practices for ERISA Plans

Cybercriminals target ERISA retirement plans due to their vulnerabilities in access and opportunity. They exploit weaknesses in systems, software, and human behavior, such as compromised credentials, to steal information. The digital nature of plan administration and reliance on third-party services create a wide attack surface for cyber threats. A breach of fiduciary duty occurs when plan fiduciaries, like administrators or trustees, fail to protect plan assets or participant data from these threats. This responsibility includes implementing adequate cybersecurity measures, addressing data breaches, and managing cybersecurity risks effectively. This article offers an in-depth analysis of these issues.

Source: Woodruffsawyer.com, May 2025

Asset Rich but Cybersecurity Poor?

Many retirement plan sponsors are still unaware that, as ERISA fiduciaries, they have a responsibility to address and mitigate cybersecurity risks to the retirement plan. Ignoring the overlap between fiduciary duties and cybersecurity obligations can lead to serious consequences. This article provides important reminders and practical protection strategies that are relevant for plan sponsors, including those from small businesses.

Source: Colonialsurety.com, April 2025

Cybersecurity and 401k Plans: Top Priority for Plan Sponsors in 2025

Cybersecurity has become an essential fiduciary obligation for 401k plan sponsors, evolving beyond a mere IT issue. With the rise of sophisticated cyber threats targeting valuable retirement accounts, employers must proactively protect participant assets and sensitive information. Fiduciaries are now required to ensure the security of these assets with the same prudence, care, and diligence as other financial responsibilities.

Source: Savantwealth.com, April 2025

Retirement Plan Suits Show Value Of Cybersecurity Policies

Recent class action lawsuits regarding data breaches indicate heightened legal risks for retirement plan administrators and sponsors. In a Law 360 Expert Analysis article, Carol Buckmann explains that these entities face potential legal action from participants whose data has been compromised, with claims involving emotional distress, invasion of privacy, and ERISA violations. Buckmann provides practical recommendations for enhancing cybersecurity measures, such as collaborating with experts, adhering to DOL best practices, training employees to identify phishing attempts, implementing multifactor authentication, and requiring regular cybersecurity audits from third-party providers.

Source: Squarespace.com, April 2025

Cybersecurity and Your Retirement Plan

The DOL has provided guidance on best practices for cybersecurity in retirement plans. While this guidance is not legally binding, it is essential for plan sponsors and fiduciaries to take it seriously. By implementing a robust data security and privacy protection policy, plan sponsors can significantly enhance the safeguarding of plan assets and create a strong defense against claims of negligence in protecting the plan and its participants. This article reviews a few key considerations to keep in mind.

Source: Gct.law, March 2025

Generative AI, Email Scams Lead Cyber Fraud in 2024

According to research from Trustpair, a significant challenge in fraud prevention is that employees often do not adhere to established fraud prevention policies. Cybersecurity is anticipated to be a major business risk in 2025, with 90% of companies reporting cyber-fraud attempts in the past year, an increase from 79% in 2023. Cyber-fraud incidents, which encompass hacking, deepfakes, voice cloning, and sophisticated phishing schemes, rose by 14% year-over-year.

Source: Planadviser.com, February 2025

The Pension Specialists Breach Exposes Data of 71,000 Participants

The Pension Specialists Ltd., a retirement plan third-party administrator, reported a data breach compromising the personal information of at least 71,443 individuals. Affected participants were notified recently about the breach, which occurred during a network disruption on February 24, 2024. An investigation revealed unauthorized access to certain files between February 18 and February 20, 2024. The company engaged cybersecurity experts and conducted a thorough review, ultimately determining on December 16, 2024, that personal information may have been exposed.

Source: Planadviser.com, February 2025

Cybersecurity: Understanding the Threats That Cyberattacks Pose

Joshua Cook, an attorney specializing in cybersecurity, emphasized the importance of trust between service providers and their employees or clients during a webinar on February 5. He highlighted that acquiring and managing private information and operating systems involves significant commitments, with maintaining security being crucial. Cook pointed out the pervasive threat of cybercrime, citing that nearly 900,000 complaints were filed with the FBI in 2024. He warned that "the threat is ubiquitous," indicating that everyone is at risk of cyber threats.

Source: Napa-net.org, February 2025

Is the Cybersecurity of Employee Benefit Plans the Employer's Problem?

U.S. employee benefit plans are increasingly targeted by criminals, with hackers stealing sensitive data and funds from retirement accounts, sometimes resulting in participants losing their life savings. Employers may assume that cybersecurity is the responsibility of financial institutions or service providers, like banks and health insurance companies, which are subject to strict regulations. However, employers also have a critical role to play in ensuring the cybersecurity of their benefit plans.

Source: Littler.com, February 2025

Cybersecurity: Form a Foundation of Trust

Joshua Cook, a cybersecurity attorney at the Wagner Law Group, emphasized the importance of trust in the relationship between service providers and their clients when handling sensitive information. In a February 5 webinar, he discussed how to establish and maintain this trust through effective cybersecurity measures. Cook highlighted the prevalent nature of cybercrime, noting that nearly 900,000 complaints were filed with the FBI in 2024, and warned that the threat of cybercrime is universal, affecting everyone.

Source: Asppa-net.org, February 2025

AI-Enhanced Fraud: A Growing Threat to Retirement Plans

Artificial intelligence is advancing rapidly, contributing to an increase in fraud and cyberattacks, particularly in phishing. Jeffrey Wu from DOL Cybersecurity LLC suggests that AI enhances the effectiveness of cybercrime by generating error-free messages, realistic images, and personalized emails using stolen information. This allows for more convincing and targeted phishing attacks, which can be automated. Wu notes that retirement plans are working to improve their defenses against the rise of AI-driven fraud, although the level of preparation varies among companies based on their size and available resources.

Source: Planadviser.com, February 2025

What Is a Proper Cybersecurity Policy for a Retirement Plan?

As cybersecurity threats, including ransomware attacks, increasingly target participant data and plan assets, plan fiduciaries must have established procedures to protect against breaches. A written cybersecurity policy detailing specific procedures is essential for plan sponsors to fulfill their fiduciary responsibilities and comply with DOL standards, as highlighted by attorney Carol Buckmann from Cohen & Buckmann P.C. While not legally mandated, this policy is as important as the plan's investment and participant procedures and should be regularly reviewed and updated due to the evolving nature of cyber threats.

Source: Planadviser.com, January 2025

Seven Cybersecurity Predictions for 2025

In 2024, cybercrime surged, becoming a top concern for business leaders, with a CFO Magazine survey indicating ransomware attacks as the primary worry for C-Suite executives. Additionally, 45% of cybersecurity leaders cited cyber incidents as the most feared source of business disruption. This trend is underscored by significant data, including $9.5 trillion in global cybercrime damages, a 10% rise in the average data breach cost to $4.88 million, a 1,265% increase in phishing emails, and a 30% rise in overall cyberattack frequency across industries. As new technologies and techniques are rapidly weaponized, cybersecurity threats are expected to escalate further in 2025. The article presents seven predictions regarding trends in cybercrime, organizational priorities, and the regulatory landscape to help businesses formulate their cybersecurity strategies for the upcoming year.

Source: Pkfod.com, January 2025

Why Your Employee Benefit Plan Needs a Cybersecurity Policy

Participant data and plan assets are vulnerable to cyberattacks, prompting the Department of Labor to emphasize the obligation of plan fiduciaries to address cybersecurity risks. However, fiduciaries may lack clarity on fulfilling these responsibilities or be unaware of existing guidelines for securing data and assets. Acknowledging that breaches can still occur, it is crucial to establish procedures for responding to such incidents, including ransomware attacks. Educating fiduciaries is best achieved through their involvement in creating a comprehensive written policy outlining specific procedures. Adhering to this policy will demonstrate their fulfillment of fiduciary responsibilities. A list of factors to consider when developing this policy is provided in this article, though it's not exhaustive.

Source: Cohenbuckmann.com, January 2025

Safeguarding Retirement in the Age of Scams

Every year, millions of older Americans face scams and fraud that threaten their retirement security. Common scams include impersonations of government agencies, banks, investment schemes, fake sweepstakes, tech support fraud, and romance scams, with new variants continually emerging. The financial services industry, retirement plan sponsors, and participants can take proactive steps to reduce scam risks. This includes utilizing technology for account verification and monitoring, educating employees on identifying scams, and encouraging participants to recognize fraud indicators and add trusted contacts to help oversee their financial accounts as they age. This is a 22-page paper on the issue.

Source: Ssrn.com, December 2024

Keeping Participant Data Safe: Duty Bound

Cybersecurity is essential for protecting retirement plans and participant data, as emphasized by industry experts Bonnie Treichel from Empower Retirement and Matt Johnson from Alpha Guard during a webinar hosted by Broadridge titled "Retirement Plan Cybersecurity: Keeping Your Participant Data Safe." They highlighted that prioritizing cybersecurity is not only wise and prudent but also a critical duty for organizations.

Source: Asppa-net.org, December 2024

The DOL Expanded Cybersecurity Guidance: What ERISA Plan Sponsors and Fiduciaries Need to Know

On September 6, 2024, the U.S. Department of Labor released Compliance Assistance Release No. 2024-01, titled "Cybersecurity Guidance Update." This updated guidance clarifies that DOL's cybersecurity protocols apply to all ERISA-covered plans, including health and welfare plans, not just retirement plans. In response to service provider concerns, the DOL emphasized the need for plan sponsors, fiduciaries, recordkeepers, and participants to implement strong cybersecurity practices across all employee benefit plans. The update underscores the importance of robust security measures to safeguard participant information and plan assets amid evolving cyber risks.

Source: Beneficiallyyours.com, November 2024

UC Schools Report Fraudulent Activity in Fidelity Retirement Accounts

The University of California reported fraudulent activity related to Fidelity retirement accounts, revealing unauthorized transactions and breaches of account security. An internal investigation uncovered multiple instances of fraud, leading the university to implement stronger security measures. Affected individuals have been advised to closely monitor their accounts for suspicious activity. Fidelity is cooperating with the investigation to improve security and prevent future incidents.

Source: Planadviser.com, October 2024

A Guide to Buying and Maintaining Cyberinsurance

Plan sponsors should understand that their fiduciary liability policy is not a substitute for cyber insurance. The cyber insurance market is intricate. Some product sellers are more knowledgeable than others, and some have access to more potential markets. Cyber insurance is not standardized, so sponsors need basic knowledge to evaluate insurance options and policy details properly.

Source: Plansponsor.com, October 2024

Insider Threats: Are Disgruntled Employees a Cybersecurity Risk?

Most plan sponsors' cybersecurity concerns are that outside hackers will attempt to get access to their systems, but disgruntled employees can also pose a threat. Internal threats account for about 20% of security threats, according to the Verizon 2022 Data Breach Investigations Report, making them rarer than outsider cybersecurity hacks. Still, certain employees, such as those in human resources, information technology, or treasury, may have access to plan information or other personally identifiable information. There are, however, ways to prevent or limit potential damage caused by disgruntled employees.

Source: Plansponsor.com, October 2024

Plan Security Relies on Vetting 3rd-Party Providers

Retirement plan recordkeepers' increasing reliance on third-party vendors for various administrative services and tools poses a challenge for plan sponsors who need to vet these vendors, especially as many have been exposed to cybersecurity breaches in the past year. To protect participant data and personal information, plan sponsors should be aware of the subcontractors with which their recordkeepers work, of which have access to participant data, and of how to respond to a breach when one occurs.

Source: Plansponsor.com, October 2024

Six Steps to Help Participants Safeguard DC Assets

In the second quarter of this year, there were 877,536 phishing attacks, according to a report by the Anti-Phishing Working Group, a not-for-profit coalition of cybercrime experts. Meanwhile, Cofense, an email security firm, notes that hackers often use times such as open enrollment and 401k updates to hack into participants' accounts. Justin Greis and Charlie Lewis, partners in consultancy McKinsey & Co., say that "no single control is a silver bullet to protect savers from becoming victims." However, they do provide six steps that fiduciaries can share with participants to help protect them from harm.

Source: Planadviser.com, September 2024

Cyber Risk and Cybersecurity for Retirement Plan Sponsors

The digital nature of retirement plan administration makes plans tempting targets for cybercriminals. From phishing attacks to account takeovers, plan participants, recordkeepers, and sponsors are at risk of significant financial losses and brand damage. In this article, learn more about cyber risk management for retirement plans.

Source: Captrust.com, September 2024

EBSA Updates Cybersecurity Guidance for Plan Sponsors and Fiduciaries

Following a 2022 recommendation from its ERISA Advisory Council, the DOL on Sept. 6 issued a new Compliance Assistance Release that provides best practices in cybersecurity for plan sponsors, plan fiduciaries, recordkeepers, and plan participants. The release updates the DOL's 2021 guidance.

Source: 401kspecialistmag.com, September 2024

DOL Updates Cybersecurity Guidance

The DOL updated its cybersecurity guidance confirming that it applies to all types of plans governed by the ERISA. The new Compliance Assistance Release provides best practices in cybersecurity for plan sponsors, plan fiduciaries, recordkeepers, and plan participants. Assistant Secretary for Employee Benefits Security Lisa M. Gomez said "These updates remind plan sponsors and fiduciaries of the critical importance of safeguarding job-based benefits and personal information."

Source: Dol.gov, September 2024

Cybersecurity Best Practices for Retirement Plans

Artificial intelligence deepfakes, including fraudulent correspondence, voice impersonations, and videos are hitting financial institutions and their customers. There is no single solution for managing these threats, especially as AI-based methods continue to evolve. However, plan advisers and their sponsor clients can implement cybersecurity plans that will help keep the bad guys at bay. In this article, experts discuss how plan fiduciaries can stay up to speed.

Source: Planadviser.com, September 2024

Keys to Guarding Retirement Plan Data Against Human Error

As the digital age evolves, so too do the risks that threaten the security of employer-sponsored retirement plans and their data. Human error within organizations poses a significant risk, as hackers are adept at taking advantage of these vulnerabilities. Understanding and mitigating these risks is therefore crucial for plan sponsors, recordkeepers, and participants alike.

Source: Planadviser.com, September 2024

Merrill Data Bungle Hits Walmart 401k Plan

Merrill Lynch is the latest broker-dealer to report a snafu in handling client private data, with the Maine Attorney General's office last week disclosing that Merrill, as the recordkeeper for Walmart's 401k plan, revealed private client information to an "unauthorized recipient" having nothing to do with the plan.

Source: Investmentnews.com, June 2024

Why Retirement Plan Sponsors and Fiduciaries Need to Know about the SEC Cybersecurity Amendments

On May 15, 2024, the SEC adopted amendments to Regulation S-P which governs the treatment of nonpublic personal information about consumers by certain financial institutions, many of which are commonly vendors and service providers to retirement plans. When assessing the cybersecurity of a retirement plan service provider that is a financial institution, plan fiduciaries may want to be aware of these SEC requirements as part of their assessment process.

Source: Workplaceprivacyreport.com, May 2024

Merrill Cyber Leak Exposes Walmart 401k Participants

Over a thousand participants in the Walmart 401k Retirement Plan were exposed to a data breach by recordkeeping provider Merrill Lynch, after an employee accidentally revealed private information that included names and Social Security numbers to an unauthorized user. The data breach impacted 1,883 Walmart employees who were enrolled in the company's 401k Retirement Plan.

Source: 401kspecialistmag.com, May 2024

J.P. Morgan Sued for Data Exposure

A participant in a retirement plan managed by J.P. Morgan Chase & Co. has initiated legal action against the company following recent reports of a data breach where over 451,000 plan participants' details were exposed. According to the lawsuit filed in the U.S. District Court for the Southern District of New York on May 3, former Long Island Railroad employee Benjamin Valentine's personal information -- which he entrusted with J.P. Morgan on the mutual understanding that the firm would protect it against disclosure -- was "targeted, compromised and unlawfully accessed due to the data breach."

Source: Planadviser.com, May 2024

A Cybersecurity Audit Survival Kit: What Plan Sponsors Must Do to Pass

Since issuing its first cybersecurity guidance in 2021, the DOL has laid out what it expects plan sponsors to do. The work requirement to follow all the DOL's cybersecurity guidance is substantial. Many organizations don't have the resources to comply fully, or they don't feel an urgency to put their resources toward it, but it appears that cybersecurity will be part of all DOL retirement plan audits. Six experts spoke with NAPA Net about what they think the DOL will expect from plan sponsors with their cybersecurity policies and procedures.

Source: Napa-net.org, May 2024

How Should a Plan Sponsor Respond to a Data Breach?

The data breach incident that took place at J.P. Morgan Chase in February, impacting more than 451,000 plan participants, serves as an opportunity for plan sponsors to reflect on their cybersecurity practices and consider what action they would take if they found themselves in a similar situation. If you were a plan sponsor, who, for example, uses J.P. Morgan as its recordkeeper, and is notified of a breach in which participant information has been exposed, what should their plan of action be?

Source: Plansponsor.com, May 2024

Retirement Plan Access and Fraud Prevention Considerations

As a significant investment for many Americans, retirement plan assets are an attractive target for cyber hackers globally. Plan participants need to take common-sense measures to safeguard their accounts. Plan sponsors face the dual challenge of providing online access to participants' retirement plans while keeping their information secure. Implementing and maintaining a proactive cybersecurity strategy is key for both parties. Here are a few items to consider.

Source: Spconsultants.com, April 2024

Plaintiffs Request Judge Approve Settlement in ERISA Data Breach Lawsuit

Retirement plan participants whose personal identifiable information was exposed in a 2021 data breach have asked a Georgia federal judge to approve an $8.733 million agreement to resolve allegations, which claimed national consultant Horizon Actuarial Services LLC failed to safeguard their sensitive data.

Source: Plansponsor.com, March 2024

Is Your Plan Cyber-Secure? Fiduciaries and Vendors Face Ongoing Challenges

No steps will ever provide 100% protection against breaches, but in this article, attorney Carol Buckmann discusses the state of the law, court cases in which participants have sued to get stolen benefits restored, and practical steps that can be taken by the company's fiduciaries to better protect participants and lower the risk of loss.

Source: Cohenbuckmann.com, March 2024

401k World: Cyber Thieves

With a quick Google search, anyone can get a sense of the massive amount of money in workplace retirement plans and individual retirement accounts. What may be less known, but not too hard to figure out for hackers, is that retirement plans' unique business model creates multiple potential openings for breaches, according to experts. This article delves into cybersecurity threats to retirement plan assets and the industry's approach to combatting them.

Source: Planadviser.com, March 2024

ERISA Fiduciary Concerns Relating to Cybersecurity: Theft of Plan Assets

Since a cyber breach is not a matter of "if," but a matter of "when," fiduciaries of retirement plans should be addressing this risk. This 4-page article discusses the DOL's authority over cybercrimes, litigation involving cyber theft of participants' accounts, and risk mitigation techniques for plan fiduciaries.

Source: Foxrothschild.com, January 2024

Canadian Plan Sponsors More Vigilant of Cybersecurity Risks When Dealing With Third-Party Vendors: Expert

Data management and transference are key areas of risk for pension plan sponsors as the vulnerability of engaging with third parties creates opportunities for cybercriminals, says Jillian Kennedy, a partner at Mercer. According to an online brief published last year by Ernst & Young, third-party service providers hired by public pension plan sponsors tend to be desirable targets of cybercriminals. Vulnerabilities can be found in plan sponsors' websites and member portals, said the report, noting investment organizations are also at risk due to the handling of investment operations conducted by its staff.

Source: Benefitscanada.com, January 2024

ERISA Fiduciary Concerns Relating to Cybersecurity: Part I -- Theft of Plan Assets

Since a cyber breach is not a matter of if it will occur, but a matter of when, fiduciaries of retirement plans should be addressing this risk. This article discusses the Department of Labor's authority over cybercrimes, litigation involving cyber theft of participants' accounts, and risk mitigation techniques for plan fiduciaries.

Source: Plusblog.org, December 2023

Retirement Plans and Cybersecurity: Insights for Plan Sponsors

With the increased regulatory focus and greater awareness of cyber vulnerabilities within the retirement plan industry, plan sponsors are looking for ways to meet their fiduciary responsibility in mitigating retirement plan cybersecurity risk. This article covers a few of the currently available ways in which sponsors can address the risk.

Source: Berrydunn.com, December 2023

Cybersecurity Triggers a New Paradigm in Vendor Monitoring

Data breach statistics have constantly pointed to third-party service providers being the most significant conduit for compromised personally identifiable information or personal health information. A new era in vendor monitoring has emerged to gain efficiency in the responsibility to oversee service providers.

Source: Rolandcriss.com, October 2023

How to Stay Safe From Evolving Cybersecurity Threats

To minimize the impact of potential cyberattacks, organizations should work with investment managers on complying with the Securities and Exchange Commission's new cybersecurity rules, should adopt prevention measures against threats, and should be prepared to respond if an attack happens, experts say.

Source: Planadviser.com, October 2023

The Future Is Now for ERISA Fiduciary Duties Around Plan Data

ERISA needs to catch up with the information age by identifying plan data as a plan asset, resolving the current ambiguity on that point that has led courts to decide otherwise, and developing the related fiduciary duties, argues Michael Schloss of The Wagner Law Group.

Source: Wagnerlawgroup.com, October 2023

What's at Risk in a Cyberattack on a DC Plan?

Every organization working with a defined contribution plan shares the responsibility for protecting from cyberattack the data, reputation, trust, and $10.2 trillion of accumulated assets in retirement plans. Safeguarding DC plans from digital security issues does not end with ensuring criminals do not steal workers' nest eggs, explains Gregg Levinson, senior director for retirement at WTW.

Source: Plansponsor.com, October 2023

Protect Against a Retirement Plan Cybersecurity Breach or Else: DOL

Earle Allen, Principal with CAPTRUST, asked former EBSA Assistant Secretary Preston Rutledge for an idea of what to expect from a DOL cybersecurity audit and how far plan sponsors and advisors should go in preventative measures. Here is the response.

Source: Napa-net.org, October 2023

MOVEit Cyberattack Ignites Worry About Fiduciary Responsibility

If there's one big takeaway for plan sponsors following the massive MOVEit cyberattack that breached the personal data of millions of participants in public pension and private-sector workplace retirement plans, it's this: They may need to rewrite their vendor contracts and redouble their monitoring of service providers. While no sponsors have yet been sued, it's not far-fetched to think that they could be, according to legal experts.

Source: Pionline.com, August 2023

New York Life Clients Latest Victims of Massive MOVEit Data Breach

Almost 26,000 New York Life customers had their names and Social Security numbers exposed to a data breach, the latest in a massive hack that affected hundreds of companies and millions of Americans. The hack occurred in late May and involved Progress Software, the provider of MOVEit transfer software. MOVEit is used to transfer client data securely.

Source: Napa-net.org, August 2023

Moveit Hack Brings Vendor Assessment to Forefront

Retirement plan providers and advisers should be taking a close look at vendor cybersecurity protocols after a software transfer hack exposed the private data of millions of people, including retirement plan participants, according to industry experts. SPARK Institute members guide how advisers can both prepare for and respond to participant data concerns stemming from the nationwide breach.

Source: Planadviser.com, July 2023

Data Breach Impacts Nearly 172,000 Tennessee Retirees

The Tennessee Consolidated Retirement System notified retirees and beneficiaries that their names, Social Security numbers, dates of birth, and mailing addresses had been compromised.

Source: 401kspecialistmag.com, July 2023

Multiple Cyber Incidents Impact Employee Benefit Plans and Participants

If a retirement plan has a business relationship with any service provider that uses, used, or may have used the MOVEit software application or RCH services, the plan should determine what fields or categories of personal information were shared with the service provider(s), and by extension MOVEit or RCH, to determine the impact on the plan and its participants. Any service agreements with the applicable vendors should also be reviewed concerning data breach notification, information reporting, and follow-up obligations of the service provider(s).

Source: Beneficiallyyours.com, July 2023

DOL Provides Cybersecurity Tips For Plan Sponsors, Participants

If it wasn't already clear to plan sponsors and retirement plan advisers, Employee Benefits and Security Administration head Lisa Gomez reiterated this week the importance of cybersecurity and increased protection for participants in a new post providing eight areas for guidance. In her blog post on the Department of Labor website, Gomez laid out various tips plan sponsors and advisers can convey to participants for keeping their information safe.

Source: Plansponsor.com, July 2023

Are Your Clients Insured Against Cyber Threats?

Experts share tips for how plan sponsors can protect themselves from the increasing threat of cybersecurity attacks and evolving litigation.

Source: Planadviser.com, June 2023

Plan Committees Need Consistent Focus on Cybersecurity

Retirement plans are a target today because that is where so much wealth is held by American savers. Therefore it is crucial for retirement plan committees -- and their advisers -- to engage in cybersecurity discussion and reviews as an ongoing part of their work.

Source: Planadviser.com, June 2023

CalPERS Cybersecurity Breach Affects 769,000 Members

A major cybersecurity breach involves one of the world's largest pension funds. CalPERS announced last week that approximately 769,000 retired members and their families had personal information exposed in a "worldwide data security incident" that impacted one of its contracted third-party vendors, PBI Research Services/Berwyn Group.

Source: Napa-net.org, June 2023

Participant Data Breach Hits Retirement Clearinghouse

Retirement Clearinghouse LLC, an industry leader in driving forward the automatic portability of retirement plans, has alerted more than 10,500 individuals that their data, including individual retirement account numbers, may have been compromised. The organization alerted individuals with written notice, dated May 12, that their information may be at risk for fraud, according to public filings in the states where they are located.

Source: Plansponsor.com, May 2023

Plan Sponsors Should 'Definitely' Have Cyber Liability Insurance: Lisa Gomez

At PSCA National just last week, ARA CEO Brian Graff and EBSA Assistant Secretary Lisa M. Gomez discussed a wide range of topics, including the many misunderstandings about cyber liability insurance (which could be a huge fiduciary failure) and the ESG rule.

Source: Napa-net.org, May 2023

401k Participant Drops Data Breach Suit Against Transamerica

A retirement plan participant has dropped a lawsuit filed against Transamerica Retirement Solutions alleging that the retirement plan provider failed to exercise reasonable care in securing and safeguarding personally identifiable information, including names, addresses, Social Security numbers, and retirement fund contribution amounts.

Source: Planadviser.com, March 2023

Who's Liable When a Plan Participant Is a Victim of Identity Theft

Because of the scarcity of case law and regulatory guidance on the issues, any case that analyzes the liability of ERISA plan sponsors and service providers following a cybersecurity incident and/or identity theft will be heavily scrutinized. A recent opinion in the Southern District of New York has widened the scope of liability for potential ERISA defendants in actions seeking to recover fraudulent distributions from ERISA-covered plans. It has also made new legal determinations that, if followed by other courts, will have an impact on future suits by plan participants seeking to recover lost retirement plan money.

Source: Wagnerlawgroup.com, February 2023

Responding to a Cyberterrorist Attack

It is a growing club that no one wants to join: the club of companies that became victims of cyberterrorism. Whether the release of credit card data from the infamous Target inside job, the gas pipeline shutdown at Colonial Pipeline, or the more recent CNA Financial ransom attack, it is often not a question of "if" a company will be attacked, but "when." Recently, a major software provider to third-party administrators joined this horrible club. The question addressed here is "What should we do about this issue?"

Source: Ntsa-net.org, January 2023

Cybersecurity: Retirement Plan Sponsors Can Protect Themselves

The digital world has opened many doors, including theft and the abuse of information. When it comes to retirement plans and participant assets, cybersecurity has emerged as a significant area of focus. This article reviews how plan sponsors can protect themselves and their participants while meeting fiduciary obligations.

Source: Captrust.com, January 2023

The Colgate Participant Account Cyber Theft Case Survives Dismissal

A New York federal district court ruled on December 19, 2022, that a participant in the Colgate-Palmolive defined contribution plan adequately alleged breach of fiduciary duty claims against the plan recordkeeper and the plan fiduciary committee. It is a curious decision that is worth studying to understand whether plan participants have potentially viable claims against the plan recordkeeper and plan fiduciaries when a participant's account is hacked.

Source: Euclidspecialty.com, December 2022

More Hackers Going After Retirement Savings, Experts Say

Employer retirement accounts are facing increasingly sophisticated attacks by hackers looking to get a slice of worker savings, and cryptocurrency investing is particularly at risk for scams, according to two financial-focused cybersecurity experts.

Source: Planadviser.com, December 2022

SPARK Releases Updated Data Security Best Practices

The SPARK Institute released Monday its Plan Sponsor and Advisor Guide to Cybersecurity, laying out its specific data security "Best Practices and seventeen Control Objectives." Developed by its Data Security Oversight Board, SPARK's best practices and control objectives establish a base of communications between recordkeepers and the public through third-party audits of cybersecurity control objectives.

Source: Planadviser.com, November 2022

SPARK Institute Releases Updated Cybersecurity Standards for Plan Sponsors and Advisors

Recordkeepers and retirement industry consultants are banding together to beef up cybersecurity. A collaborative effort between recordkeepers and consultants leads to updated Data Security Best Practices and a new Plan Sponsor and Advisor Guide to Cybersecurity to strengthen the retirement industry's defenses against cyber criminals.

Source: 401kspecialistmag.com, November 2022

Cybersecurity: Insights and Action Steps

Cybercriminals are creative and resourceful and they're not just after bank accounts. Industry experts in a recent webinar cautioned that retirement plans are in their sights as well. This article outlines some concrete steps that can be taken to address and protect retirement plans against cybercrime.

Source: Ntsa-net.org, October 2022

Cybersecurity Breach Suits Raise Questions About Liability for Benefits Plans

Cybersecurity breaches concerning workers' personal information and retirement savings have increased liability risks for benefit plans and third-party administrators under federal benefits laws. In February 2021, the GAO issued a report warning about these increased legal risks for ERISA plan fiduciaries due to cyber breaches. The GAO also warned that outsourcing various functions involving retirement plans to third-party administrators could increase the potential for unauthorized access to participants' information. In recent years, the GAO's warnings have become a reality.

Source: Hallbenefitslaw.com, October 2022

Is It Time for ERISA to Be Amended to Cover Cyber Crimes?

It is no surprise that cyberattacks are a grave concern for sponsors of retirement plans. Under ERISA fiduciaries and persons handling funds must be bonded to protect against fraud and dishonesty. This article discusses this required ERISA bond and the interplay of other types of insurance coverage and concludes with a recommendation that Congress amend ERISA to require insurance to address cyber crimes.

Source: Foxrothschild.com, October 2022

Common Myths of Cyber Insurance for Employee Benefit Plans

Cyber insurance is a critical component of the cyber security risk management program necessary to protect employee benefit plans and participant retirement assets. But the current way plan fiduciaries seek cyber and crime coverage needs to change and this article explains why.

Source: Euclidspecialty.com, October 2022

In Cybersecurity Enforcement Action, Seventh Circuit Rejects Service Provider's Challenges to DOL Subpoena

In an enforcement action involving an administrative subpoena seeking documents from a service provider for employer-sponsored health and retirement plans, the Seventh Circuit held that the DOL's investigatory authority under ERISA is not limited to ERISA plan fiduciaries. The Seventh Circuit also concluded that the subpoena was not too indefinite or unduly burdensome.

Source: Westlaw.com, October 2022

401khelpcenter.com, LLC is not the author of the material referenced in this digest unless specifically noted. The material referenced was created, published, maintained, or otherwise posted by institutions or organizations independent of 401khelpcenter.com, LLC. 401khelpcenter.com, LLC does not endorse, approve, certify, or control this material and does not guarantee or assume responsibility for the accuracy, completeness, efficacy, or timeliness of the material. Use of any information obtained from this material is voluntary, and reliance on it should only be undertaken after an independent review of its accuracy, completeness, efficacy, and timeliness. Reference to any specific commercial product, process, or service by trade name, trademark, service mark, manufacturer, or otherwise does not constitute or imply endorsement, recommendation, or favoring by 401khelpcenter.com, LLC.

About | Glossary | Privacy Policy | Terms of Use | Contact Us

This work is licensed under a Creative Commons Attribution-NoDerivatives 4.0 International License.