Cyberwellness with Brian Gault of Fidelity

Rising Stakes in Plan Cybersecurity

Retirement plans manage trillions in assets and sensitive personal data for millions of Americans, making them attractive targets for cybercriminals. Breaches at recordkeepers or sponsors can lead to direct financial harm—fraudulent distributions, identity theft—and indirect damage through eroded trust in the retirement system.

Regulatory momentum has intensified. The SEC's 2023 rules mandate rapid public disclosure of material cybersecurity incidents, a requirement that persists with no major rollbacks in 2026 and applies to many public companies sponsoring or administering plans. Parallel efforts from federal banking agencies and proposed CIRCIA rules aim to standardize reporting for critical infrastructure, including financial services, with refinements debated in early 2026 town halls.

State regulators add layers: New York's Part 500 amendments, phased in post-2023, demand annual certifications, penetration testing, and enhanced controls for covered entities, influencing national practices given New York's market weight.

The stakes are concrete. Participants suffer most directly from fraud enabled by stolen credentials or breached systems, while sponsors face ERISA fiduciary claims if deemed negligent in oversight. High-profile cases have resulted in substantial settlements, alongside DOL investigations.

Less visible are trade-offs: regulations set floors that may lag behind threats like ransomware-as-a-service or third-party vulnerabilities, forcing sponsors to invest beyond compliance. Smaller employers struggle disproportionately, lacking in-house expertise yet facing the same standards as giants. Concentration among a few dominant recordkeepers creates systemic risks—if one falters, ripple effects could disrupt millions of accounts.