Data Breach Risks For 401(k) And Retirement Plans

There has been a recent spike in attacks on 401(k) and retirement plans by cyber criminals. Some have been reported publicly, and we are aware of several nonpublic incidents as well.

A data breach is a disruptive event. For plan fiduciaries, there are several factors that create heightened risk. First, an attack can result in loss of personally identifiable information and theft of funds. Recent incidents have seen cyber thieves empty accounts of plan participants, including C-suite executives. For business relations reasons, corporate plan sponsors have taken responsibility for making plan participants whole.

Second, plans use third-party service providers to administer accounts and handle data. Yet, plan fiduciaries may remain responsible for their actions under ERISA, and they are generally obligated to provide prudent oversight.