In 2023, the CFPB declared a major breach that affected about 256,000 consumers and 46 institutions after an employee sent confidential supervisory information to a personal email account. We found that the CFPB's guidance does not sufficiently limit access to confidential supervisory information. Its guidance also lacks expectations for assessing the severity of confidential supervisory information breaches and enforcing consequences for responsible employees

... Read full text