In March 2023, a former Consumer Financial Protection Bureau employee transferred confidential information from seven financial firms to a personal email account without authorization. The material was sent in 14 emails and included personally identifiable information involving approximately 256,000 consumers and records connected to 45 financial institutions. Two spreadsheets contained consumer names and transaction-specific account numbers for roughly 256,000 accounts at one institution. The CFPB and the affected firms did not publicly identify the employee or the institutions.
The bureau became aware of the misuse on February 14, 2023, and notified U.S. lawmakers on March 21; the incident became public on April 24. The disclosure exposed weaknesses in access controls and employee offboarding for a federal agency entrusted with sensitive financial-complaint data, although the supplied account does not report evidence of criminal charges, financial losses, or a confirmed public sale of the information. After the breach, Senator Ted Cruz and Representative Donalds authored legislation seeking to eliminate the CFPB, turning the incident into a political argument over the agency’s oversight and data-governance practices. A policy group’s subsequent advocacy initiative reflected those concerns but did not itself constitute a government finding or enforcement action.
