2023 Consumer Financial Protection Bureau data breach

The Consumer Financial Protection Bureau (CFPB) experienced a significant security breach in March 2023 when a former employee transferred confidential information on approximately 256,000 consumers and forty-five financial institutions to their personal email account.^[1][2] The unauthorized transfer involved data from seven firms, though the majority of the consumer information came from one institution.^[1] The data was sent over fourteen emails and it contained personally identifiable information (PII) of consumers.^[3] The employee also sent two spreadsheets with names and transaction-specific account numbers for about 256,000 consumer accounts at a single institution.^[3] Neither the firms nor the employee have been publicly identified.^[1]

The CFPB first became aware of abuse on 14 February 2023.^[4][2] They informed U.S. lawmakers of the incident on March 21, but it was not made public until April 24.^[1][2][5] Shortly following the data breach, Senator Cruz and Rep Donalds authored a bill seeking to eliminate the CFPB.^[6]

In response to the 2023 data breach, the Southwest Public Policy Institute (SPPI) established the Bureau to Protect Financial Consumers (BPFCCFPB) to advocate for better oversight and protection of consumer data.^[7] The Institute claims this initiative reflects broader concerns about data security and management practices within governmental consumer protection agencies.