CFPB flunks cybersecurity audit amid staff cuts: OIG report
Will Oliver/Bloomberg
Processing Content
- Key insight: Staff cuts, outdated security policies and unpatched vulnerabilities are among the reasons the CFPB is vulnerable to cyberattacks, according to a new inspector general report.
- Expert quote: “The agency does not consistently track data assets, cannot validate the security of hardware located in former regional offices, and lacks processes to ensure its system interconnections inventory is complete and accurate,” —the Office of Inspector General for the Federal Reserve Board and CFPB.
The Consumer Financial Protection Bureau is exposing millions of sensitive financial records to mounting cyber threats, an inspector general has found, saying that the agency failed its annual cybersecurity audit.
In a scathing
The findings paint a troubling picture of a short-staffed agency during the second Trump administration. The CFPB has failed to adequately protect millions of confidential supervisory records on financial institutions, consumer complaints and financial information, the report found.
“The CFPB’s information security policies and procedures do not reflect current federal requirements or operational practices, creating gaps that limit the agency’s ability to effectively manage cybersecurity risk,” the report states. “The agency does not consistently track data assets, cannot validate the security of hardware located in former regional offices, and lacks processes to ensure its system interconnections inventory is complete and accurate.”
Under former acting Director Russell Vought, the CFPB vacated four regional offices in 2025, but allowed computers to remain in those offices without verifying if the equipment, which the agency owns, was properly secured from unauthorized access. The lapse prompted an urgent IG management alert demanding an immediate site-by-site decommissioning, the report stated.
On Tuesday, the National Treasury Employees Union Local 335 held a call with its members and stated that equipment left in regional offices in Chicago, New York and San Francisco had to be cleared out by employees after those offices were left vacant for months, a source told American Banker.
The IG audit cited the massive reduction in staff as the root cause for the bureau’s recent cybersecurity lapses.
More than 500 employees — or a third of the CFPB’s workforce — have left the agency since the Trump administration took over in early 2025, the report found. The exodus forced remaining staffers to absorb double duties. Enterprise risk management activities were suspended for over a year, the report found.
“Until these foundational fixes are fully implemented, America’s financial watchdog remains dangerously vulnerable to cyber exploits,” the IG stated.
The CFPB scored a two out of five on IG metrics requiring federal agencies to score at least a four to ensure adequate data protection. The level-two rating is the lowest the CFPB has received since the OIG began using a five-level model in 2017.
Read more:
Critically, the CFPB’s data-inventory team has been reduced to just one person, and the CFPB has not documented how often the data inventory should be reviewed and updated, the report said.
Christopher Chilbert, the CFPB’s chief information officer, said in a two-page response to the report that the bureau has addressed most of the IG’s past recommendations.
“Notably, and most importantly, the bureau did not have any major security incidents or breaches of personally identifiable information in FY 2026 despite facing increasingly sophisticated threats,” he wrote in the agency’s response.
The CFPB has submitted evidence to address eight new recommendations by year end, and to close nine of the 10 past recommendations that remain open.
Still the report highlights the CFPB’s lax stance toward critical software flaws.
Internal scans in mid-2026 flagged high-severity vulnerabilities and “end-of-life platforms” no longer supported by vendors. Yet, the CFPB failed to create formal tracking plans until IG auditors requested documentation, leaving critical flaws unpatched well beyond the required 30-day window, the report found.
The CFPB “cannot effectively oversee and manage information sharing between its systems and external entities,” issues that can result in unmanaged security risks, the IG noted.
The report also said that many of the IG’s recommendations “address foundational control weaknesses.”
“Persistent unresolved recommendations in areas like cybersecurity risk registers, data classification and loss prevention, vulnerability remediation tracking, and contingency planning prevent the CFPB from demonstrating the consistent implementation and effectiveness required to achieve higher maturity levels,” the report stated. “Until these recommendations are fully implemented, the CFPB will continue to face challenges in establishing the managed and measurable security posture necessary for an effective information security program.”
