Loading story…
The U.S. Government Accountability Office found that service providers for employer-sponsored retirement plans may share or sell participants’ sensitive personal and financial data for marketing or to data brokers. Of 31 providers whose privacy disclosures GAO reviewed, 29 either allowed such marketing-related sharing or did not say whether it was restricted, and 17 did not limit sales of participant data to brokers or other third parties. The affected information can include Social Security numbers, account details, and retirement-account balances for a population of more than 126 million participants holding over $9 trillion in assets.
GAO warned that expanded access to this data raises risks of unwanted marketing, identity theft, and fraud. It said the Employee Retirement Income Security Act lacks explicit modern privacy provisions, while the Labor Department’s 2021 cybersecurity guidance does not clearly define protected participant data or when written authorization is necessary for its use or disclosure. GAO recommended that the Department of Labor clarify both requirements; the department said it supports protecting participant information and will consider issuing supplemental guidance.
See the reporting duties and controls this puts on the clock.
3 events from the most recent confirmed update back to the earliest known activity.
GAO published a WatchBlog post discussing report GAO-26-107271, finding that 29 of 31 reviewed retirement-plan service providers allowed or did not specify limits on marketing-related data sharing, and that more than half did not limit sales to data brokers or other third parties. GAO recommended that the Department of Labor clarify what data is private and when written permission is required for its use or disclosure.
The U.S. Department of Labor issued cybersecurity guidance for retirement plans that called for service-provider obligations to protect private information and prevent use or disclosure without written permission.
The Department of Labor said it supports appropriate protection of retirement-plan participant and beneficiary information and would consider issuing supplemental guidance aligned with GAO's recommendations as resources permit. The department neither agreed nor disagreed with the recommendations.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Federal agencies are increasingly transitioning from paper-based to digital processes to improve efficiency and reduce costs, but this shift introduces significant data privacy and security challenges. Sensitive information, once protected by physical controls, is now at risk of exposure through outdated digital documents, email transmissions, and accidental disclosures by employees. The persistence of static documents and hybrid workflows further complicates efforts to secure sensitive data, leaving organizations vulnerable to both insider threats and external attacks. A recent Government Accountability Office (GAO) report highlights that the Department of Defense (DoD) is not adequately training its personnel or issuing sufficient guidance to prevent the leakage of sensitive information online. Social media activity by military members, their families, and even official press releases have been identified as sources of operationally sensitive data, which could be exploited for blackmail or to disrupt military operations. The GAO's findings underscore the broader risks associated with digital information management in government, emphasizing the need for robust privacy and security measures as agencies modernize their workflows.
Jul 12, 2026
A report from Senator Gary Peters highlighted significant cybersecurity and privacy risks stemming from the Department of Governmental Enterprises (DOGE) operating outside federal data governance laws, warning that unrestricted employee access to sensitive data could lead to vulnerabilities and corruption. In parallel, a group of senators introduced the Management of Individuals’ Neural Data Act of 2025, directing the Federal Trade Commission to establish standards for protecting consumers’ neural data from misuse by tech companies and data brokers. The proposed legislation aims to prevent exploitation and manipulation of individuals through unregulated collection and use of brain activity data, emphasizing the need for strong privacy safeguards and oversight. Both actions reflect growing congressional concern over the lack of federal controls on the collection and handling of highly sensitive personal data by both government entities and private companies.
Jun 29, 2026
Figure and Allianz Life disclosed separate breaches in which attackers used **social engineering** to gain access to systems holding large volumes of customer data. Figure said an employee was deceived into granting access, leading to the public posting of a dataset from January 2026 that contained more than **900,000 unique email addresses** as well as names, phone numbers, physical addresses, and dates of birth. Allianz Life reported that a cyberattack in July 2025 targeted data stored on **Salesforce** and was later followed by the online leak of **1.1 million unique email addresses**. The exposed Allianz Life records also included names, genders, dates of birth, phone numbers, and physical addresses, underscoring how social engineering attacks continue to drive large-scale exposure of sensitive personal information across financial services firms.
Jun 29, 2026