{"id":588,"date":"2023-04-20T15:52:05","date_gmt":"2023-04-20T20:52:05","guid":{"rendered":"https:\/\/kentprotect.com\/?p=588"},"modified":"2023-04-22T06:03:52","modified_gmt":"2023-04-22T11:03:52","slug":"breach-report-cfpb-employee-forwards-256000-sensitive-records-to-personal-email","status":"publish","type":"post","link":"https:\/\/kentprotect.com\/index.php\/2023\/04\/20\/breach-report-cfpb-employee-forwards-256000-sensitive-records-to-personal-email\/","title":{"rendered":"Breach Report: CFPB employee forwards 256,000+ sensitive records to their personal email"},"content":{"rendered":"
<\/div>\n

One-sentence summary:<\/strong><\/p>\n\n\n\n

A CFPB employee breached the sensitive data of over 256,000 consumer accounts and 45 financial institutions by forwarding the data to their personal email. <\/p>\n\n\n\n

Who was involved?<\/strong><\/p>\n\n\n\n

CFPB (Consumer Financial Protection Bureau), a CFPB employee, and 256,000 consumers (and, potentially, 45 financial institutions). <\/p>\n\n\n\n

What was the timeline?<\/strong><\/p>\n\n\n\n

February 14, 2023: CFPB learns of the data breach <\/p>\n\n\n\n

March 21, 2023: CFPB notifies Congress of the breach <\/p>\n\n\n\n

April 19, 2023: Sen. Tim Scott requests information from the CFPB <\/p>\n\n\n\n

May 8, 2023: Deadline given for CFPB to respond <\/p>\n\n\n\n

What occurred?<\/strong><\/p>\n\n\n\n

A CFPB employee forwarded the sensitive data of over 256,000 consumer accounts and “45 financial institutions” to their personal email (Pymnts, 2023). The CFPB Office of Inspector General (OIG) is currently investigating the incident (Pymnts, 2023). The employee was terminated after the breach was discovered (O\u2019Donnell, 2023). The former employee is also alleged to have not deleted the sensitive data (Pymnts, 2023). <\/p>\n\n\n\n

Estimated costs:<\/strong><\/p>\n\n\n\n

TBA<\/p>\n\n\n\n

Involved laws:<\/strong><\/p>\n\n\n\n

TBA<\/p>\n\n\n\n

Root cause:<\/strong><\/p>\n\n\n\n

Insider: employee<\/p>\n\n\n\n

Lessons learned:<\/strong><\/p>\n\n\n\n

DLP (Data Loss Prevention) technologies are of substantial importance when planning and responding to potential insider threats. Email DLP solutions can proactively detect and prevent breaches similar to these by stopping the breach at the mail gateway and quarantining affected data. It is going to be interesting to see how the breach was able to occur with these potential controls in place since the size was so large.<\/p>\n\n\n\n

Example DLP Solutions: <\/em><\/p>\n\n\n\n

Proofpoint Email DLP: https:\/\/www.proofpoint.com\/us\/products\/information-protection\/email-dlp<\/p>\n\n\n\n

Armorblox Email DLP: https:\/\/www.armorblox.com\/learn\/email-dlp\/<\/p>\n\n\n\n

Mimecast Email DLP: https:\/\/www.mimecast.com\/content\/email-data-loss-prevention\/<\/p>\n\n\n\n

Forcepoint Email DLP: https:\/\/www.forcepoint.com\/product\/dlp-cloud-email<\/p>\n\n\n\n

Sources:<\/strong><\/p>\n\n\n\n

CFPB. (n.d.). logo_open-graph_facebook.d0dedfbe1787.png<\/em>. consumerfinance.gov. https:\/\/www.consumerfinance.gov\/static\/img\/logo_open-graph_facebook.d0dedfbe1787.png<\/p>\n\n\n\n

O\u2019Donnell, K. (2023, April 19). CFPB says employee breached data of 250,000 consumers in \u2018major incident.\u2019<\/em> POLITICO. Retrieved April 20, 2023, from https:\/\/www.politico.com\/news\/2023\/04\/19\/cfpb-employee-consumer-data-breach-00092919<\/p>\n\n\n\n

Pymnts. (2023, April 20). CFPB Data Breach Exposes Data of 250,000 Consumers and 45 Banks. PYMNTS.com<\/em>. https:\/\/www.pymnts.com\/news\/cfpb\/2023\/cfpb-suffers-data-breach-involving-consumers-and-financial-institutions\/<\/p>\n\n\n\n

Commentary: <\/strong><\/p>\n\n\n\n

This report will be updated after the Congressional testimony is made by the CFPB. <\/p>\n\n\n\n

\n