WASHINGTON — The Consumer Financial Protection Bureau is failing to adequately safeguard computer systems holding millions of consumer complaints, sensitive financial information and confidential records about financial institutions, according to a federal watchdog audit reported Wednesday.
The Federal Reserve-CFPB Office of Inspector General found the agency’s information security program was “not effective,” citing incomplete inventories of data and equipment, delays in correcting serious vulnerabilities and outdated cybersecurity policies. The findings raise concerns about possible unauthorized access or theft, although the audit did not establish that the databases had been breached.
Reuters reported that the findings come amid upheaval at the CFPB following the Trump administration’s efforts to sharply reduce the agency’s operations, staffing and contracts. Bloomberg Law separately reported that staffing shortages have hampered efforts to correct longstanding cybersecurity weaknesses.
Security Failures Identified
The inspector general rated the CFPB at level 2 on a five-level federal cybersecurity maturity scale, below the level 4 standard considered effective. The same office rated the program at level 4 in 2024 before lowering its assessment to level 2 in 2025.
Among the problems identified in the 2026 audit:
- Several datasets actively used by the bureau were missing from its data inventory, limiting its ability to identify and protect information.
- Critical and high-severity cybersecurity vulnerabilities were not fixed within the required 30-day period, although the agency subsequently developed plans to address them.
- Risk-management procedures and security policies were incomplete or outdated, including business impact analyses for nine newly authorized systems.
- Computer equipment at vacated regional offices was not adequately inventoried or verified as secure.
- Ten of 14 previously unresolved inspector general recommendations remained open.
The audit said departures of employees responsible for data inventories and information standards had weakened the bureau’s capacity to maintain basic security processes. It noted that 524 of the agency’s 1,758 employees left between Sept. 30, 2024, and Dec. 31, 2025, according to a CFPB report to Congress.
Separate Warning About Office Equipment
In a Sept. 30 management alert, the inspector general warned that hardware left at former CFPB regional offices had not been verified as secure. FedScoop reported that the offices included Atlanta, Chicago, New York and San Francisco.
The CFPB disputed the suggestion that sensitive databases were located in those offices, according to FedScoop, but said it had begun a site-by-site decommissioning process. The inspector general said the lack of verification left uncertainty about whether equipment or any information stored on it had been accessed or removed.
Agency Accepts Recommendations
The 2026 audit made eight new recommendations involving asset inventories, risk-management practices and updated policies. The CFPB agreed with the recommendations.
In a written response cited by Reuters, CFPB Chief Information Officer Christopher Chilbert said the agency had already addressed most of the recommendations and would continue making improvements. He also said the bureau had reported no major security incidents or breaches involving individuals’ personal information during the most recent federal fiscal year.
The audit findings describe weaknesses that could increase exposure to cyberattacks; they do not constitute evidence that hackers stole consumer information.
