| 401(k) investors vulnerable to cyber hacks, watchdog warns | | |  | WED, MAR 17, 2021 | | | | Is the money in your 401(k) plan safe?
It may not be as secure as you believe it is, since cyberattacks on retirement plans are increasing.
These sophisticated attacks target 401(k) plans through phishing emails containing subject lines like "Changes to your 401(k) Plan" or "401(k) Open Enrollment," in an attempt to trick participants into revealing their 401(k) plan usernames and passwords.
Cybercrime experts say that 401(k) accounts may be particularly vulnerable to fraud because accountholders may not interact with them frequently, so they lack daily attention. Additionally, plans are only required to send quarterly statements and participants are usually advised to leave their 401(k) accounts alone, so most people don't view them on a consistent basis.
It's obviously a big threat to individuals who have their retirement savings in these plans. So, what is being done to protect those retirement accounts?
Not a great deal.
Apparently, many 401(k) plan sponsors mistakenly believe that when they delegate responsibilities to a record-keeping service provider, they have no liability for these cybersecurity breaches, experts explain. However, all 401(k) plan fiduciaries have an obligation to keep the personal information of plan participants secure and private. Although plan sponsors delegate cybersecurity responsibility to recordkeepers, they have a fiduciary duty to ensure that recordkeepers maintain a cybersecurity program.
CNBC reporter Greg Iacurci writes that the Government Accountability Office has taken notice. The federal watchdog group has concluded that the Labor Department, which regulates the U.S. retirement system, hasn't kept pace with the ramifications from cyberattacks on 401(k) plans.
The Labor Department needs to do more to protect 401(k) investors from cyberattacks at a time when their sensitive personal information is increasingly being shared over the internet, the GAO reports. However, the Labor Department hasn't clarified whether reducing cyber risk is a fiduciary duty, the federal watchdog said. The agency also hasn't issued minimum expectations for the protection of personal data, and investors can't be assured it's being adequately protected, the GAO said.
The GAO recommends that the agency takes action on both of these steps.
For more key stuff like this, please follow me on Twitter @jimpavia and check out CNBC's Financial Advisor Hub and CNBC + Acorns Invest in You: Ready. Set. Grow. | |
EmoticonEmoticon