A recordkeeper data breach is the kind of event that arrives as a polite email from your provider and turns into a fiduciary problem within hours. The recordkeeper may be the one whose systems were hit, but participant data, plan assets and the oversight duty all belong to the plan, and the plan’s decisions run through you. This post explains what plan sponsors must do next, what to put in writing, and which duties cannot be handed to the vendor.
Why a Recordkeeper Breach Is a Fiduciary Event, Not Just an IT Event
Selecting and monitoring service providers is a fiduciary function. When a provider that holds your participants’ names, Social Security numbers, balances and bank details reports a breach, the question a regulator or plaintiff will ask is simple: what did the sponsor do once it knew? Silence, delay or a forwarded email with no follow-up is the weakest possible answer.
Common ways sponsors get hurt:
- Treating the vendor’s notice as the vendor’s problem and taking no documented action.
- Assuming the recordkeeper’s contract already covers notification, credit monitoring and losses, without reading it.
- Letting participants hear about the breach from the media or a letter before hearing from the employer.
- Continuing to process distributions and loans through a compromised channel without added verification.
For the broader duty to protect participant data, see our guide on 401(k) cybersecurity and participant data.
The First Hours: Triage Steps
1. Identify Who Owns the Response Inside Your Company
Name one accountable person and a small group (HR, finance, legal or outside counsel, IT, and your plan committee chair). Decide who speaks to the recordkeeper, who speaks to participants, and who keeps the log. If your plan has a named fiduciary or committee, route decisions through it so they are recorded as plan decisions, not ad hoc reactions.
2. Preserve the Notice and Start a Log
Save the original notice, the sender, the time received and every later communication. Start a running log of calls, questions asked, answers received and decisions made. This log becomes your evidence of prudence if anyone later reviews the response.
3. Ask the Recordkeeper the Right Questions in Writing
Do not rely on a phone call. Put your questions in an email so the answers are on the record, and ask for written responses.
What to Demand From the Recordkeeper
1. Scope: Was Your Plan Affected?
Ask whether your plan’s data was accessed, which data elements were involved, which populations (active participants, terminated participants with balances, beneficiaries, alternate payees) and whether any plan assets or accounts were touched.
2. Timeline and Containment
Ask when the incident began, when it was discovered, when it was contained and whether it is still ongoing. Request the status of any forensic investigation and when findings will be shared with clients.
3. Participant Notification Plan
Ask who is sending notices to participants, what they will say, what remediation (such as credit monitoring) is being offered and who pays. Confirm that the notice population will be built from the recordkeeper roster, including former employees with balances, beneficiaries and alternate payees, not just current payroll.
4. Account Protection Measures
Ask what additional authentication is now required for distributions, loans, address changes and bank-detail changes, and whether any pending transactions are being held for review.
5. Contract, Indemnity and Insurance
Ask for confirmation of the provider’s cybersecurity insurance and its position on responsibility for losses. Compare the answer with your service agreement. Our 408(b)(2) fee disclosure review is a useful place to start if you cannot locate what the agreement actually promises.
Protecting Participants and Plan Assets Right Now
1. Add Friction to Money Movement
Work with the recordkeeper to tighten verification on distributions, loans and rollovers for affected participants. A fraudster with stolen data tries first to change contact information and then to take money out.
2. Watch for Unusual Activity
Ask for exception reports on address changes, new bank instructions and password resets. Review them on a regular cadence while the situation is open and record that you did so. Our post on participant data reconciliation explains how to compare payroll and recordkeeper records, which helps spot records that do not belong.
3. Consider Whether Your Own Systems Were Exposed
Your payroll file, census uploads and employer portal credentials may sit alongside the compromised environment. Reset portal credentials, review who has access and confirm that data feeds are going to the right places.
Communicating With Participants
The recordkeeper may send legally required breach notices, but participants will look to the employer. Coordinate so the messages do not contradict each other.
- Say what happened in plain language, what data was involved and what is being done.
- Tell participants what they can do: monitor accounts, review statements, enable multi-factor authentication where available.
- Provide one point of contact inside the company and one at the recordkeeper.
- Keep copies of everything sent and how it was delivered, since delivery proof matters. See our guide to electronic disclosure safe harbors if you send notices online.
Breach notification laws vary by state and by the data involved. Confirm your obligations with counsel rather than assuming the vendor has satisfied them on your behalf.
Evaluate the Provider Afterward: The Monitoring Duty
1. Request the Post-Incident Report
Once the investigation concludes, ask for a written summary of root cause, what was fixed and what controls changed. Add it to your provider file.
2. Re-Review Security Practices
Ask for current third-party security assessments, a description of encryption and access controls, and how the provider tests its defenses. The DOL’s cybersecurity guidance gives sponsors a framework for what to ask; our post on participant data security walks through it.
3. Decide Whether the Relationship Should Continue
A breach does not automatically require a change of provider, but it does require a documented decision. Weigh the response, transparency, remediation and contract protections. If you do decide to move, plan the transition carefully, since a conversion creates its own risks. See blackout notices and recordkeeper conversions and switching 401(k) providers mid-year.
4. Record the Decision in Committee Minutes
Whichever way you go, the reasoning belongs in the minutes. Our guide to plan committee meeting minutes covers what to record.
An 8-Step Self-Check for Sponsors
- Is the original breach notice saved and a response log started?
- Is one person accountable and a response group named?
- Did you send written questions about scope, timeline and containment?
- Do you know which populations were affected, including former employees and beneficiaries?
- Are extra verification steps in place for distributions, loans and bank changes?
- Has participant communication been coordinated with the recordkeeper and reviewed by counsel?
- Did you review your service agreement, indemnity language and insurance, including your fiduciary coverage? See fidelity bonds and fiduciary insurance.
- Is the final decision on the provider documented in committee minutes?
What You Can Delegate and What You Cannot
A 3(16) administrator can run the operational response: collecting provider documentation, tracking participant notices, monitoring exception reports and keeping the evidence file in order. That is the day-to-day work of 3(16) plan administration.
Some decisions stay with the employer. Whether to keep or replace the recordkeeper, how to communicate with your workforce and what the company will pay for remain settlor and business decisions, and only you hold the facts about your own systems and payroll feeds. Delegation moves the work and the liability for executing it, not your accountability for choosing and overseeing providers. For a deeper explanation, see transferring fiduciary liability.
Put a Named Fiduciary Behind the Response
In a breach, the hardest question is often who decides. Most providers will run the operational work but decline to take the formal decision-making role. Admin316 accepts formal appointment as your plan’s ERISA 402(a) named fiduciary, so the authority to manage the plan and oversee its providers is documented in a single accountable place. Learn more about 402(a) fiduciary services.
If your recordkeeper has reported an incident, or you want a response plan in place before one happens, book a time with Admin316 and we will walk through your plan’s exposure and next steps.
