A new report from the Federal Reserve Board’s Office of Inspector General has revealed that the Consumer Financial Protection Bureau lacks adequate controls to prevent and respond to breaches of confidential supervisory information (CSI), including one serious 2023 incident that exposed data on 256,000 consumers and 46 financial institutions.
📂 What happened: In 2023, a CFPB examiner forwarded roughly 65 emails containing CSI and personally identifiable information (PII) to their personal email account over the course of a year. This prompted the Bureau to declare its first-ever major security breach, triggering an internal review.
🔍 What the watchdog found: The report, released this week, from the OIG identifies multiple systemic weaknesses at the Bureau:
- CFPB guidance fails to define clear rules for who can access CSI in its systems.
- No formal “need-to-know” protocol exists for limiting access to CSI, and staff were often granted access without justification.
- The Bureau lacks a consistent process for assessing the severity of CSI breaches or holding employees accountable.
- No internal trend analysis is conducted to address recurring problems.
- Incredibly, there is no standard protocol for notifying financial institutions affected by a CSI breach — leaving some institutions unaware they were impacted.
🛠️ Recommendations made: The OIG issued seven recommendations, including establishing formal access procedures, enhancing training, conducting breach trend analysis, and developing a consistent breach notification process for impacted institutions. While the CFPB agreed with most suggestions, it failed to provide implementation timelines or address one recommendation entirely.
💬 Between the lines: The CFPB’s sloppiness in securing confidential data isn’t just an internal issue — it has real-world consequences for financial institutions and consumers. One regional office handled breach notifications via email, another by phone, and others didn’t notify institutions at all. The watchdog warns that such inconsistencies could increase reputational risk for the Bureau and affected entities.
Read the report. Read the report summary
