Real-world cybersecurity breaches from the past three years reveal why strong security is no longer optional in retirement administration.
Compiled by Mike Parker, CEOLast updated: October 4, 2026
Third-Party Administrators manage sensitive participant and financial data—making them prime targets for cyberattacks. These aren't hypothetical risks. Each summary below highlights key facts with a link to the original public report.
Each incident below is summarized from publicly reported sources, which are linked in each entry. Descriptions reflect what was publicly reported as of the date of publication and are provided for educational purposes only. TPAIT® is not affiliated with, and makes no assertion of wrongdoing by, any organization named. If you believe an entry is inaccurate or out of date, contact hello@tpait.com and we will review it promptly.
11
Documented incidents, 2023–2026
4.4M+
People notified across these incidents
$1.2M
NWRPC class-action settlement (2026)
$1.4B
Recovered by EBSA for plans and participants, FY 2025
TPA & retirement-industry breach summary (sources linked in each report below) — Updated October 2026
Between April 18 and April 23, 2023, an attacker stole personal data, including names, contact details, dates of birth, insurance information and Social Security numbers, from the network of WebTPA, a third-party administrator for health insurance and benefit plans. WebTPA found the intrusion on December 28, 2023, more than eight months later, and began mailing notices to individuals in April 2024.
What This Means for Your Firm: Delayed breach detection is common. Continuous monitoring and rapid incident response protocols aren't luxuries—they're requirements.
Pension Benefit Information (PBI) – MOVEit Breach (2023)
Impact: Up to 1.2 million individuals
On May 29 and 30, 2023, the Clop ransomware group used a then-unknown flaw in Progress Software’s MOVEit Transfer tool to get into one of PBI’s file-transfer servers. The stolen files held names, partial mailing addresses, dates of birth and Social Security numbers for up to 1,209,825 people. PBI provides pension management services; its clients include insurance companies, financial institutions and third-party administrators.
What This Means for Your Firm: Your recordkeepers and software vendors are extensions of your security perimeter. Document your vendor security requirements and conduct annual vendor risk assessments.
J.P. Morgan – Retirement Plan Participant Data (2024)
Impact: More than 451,000 plan participants
A software flaw, not a cyberattack, let three system users linked to J.P. Morgan customers or their agents see plan participant data they were not entitled to view, through reports they ran between August 26, 2021 and February 23, 2024. J.P. Morgan found the problem on February 26, 2024. The data included names, addresses, Social Security numbers and payment and deduction details, plus bank routing and account numbers for participants paid by direct deposit.
What This Means for Your Firm: Access rules inside reporting tools need testing too: this exposure came from legitimate users running reports, not from hackers. And when any provider that touches participant data has an incident, plan sponsors look to every firm in the chain for answers, so agree on incident coordination steps with each one in advance.
Alera Group, a provider of risk management, insurance and financial services, detected suspicious network activity in August 2024. Its investigation found unauthorized access between July 19 and August 4, 2024. A review of the affected files finished on April 28, 2025, and the incident was first announced on May 21, 2025. Data that may have been taken included names, Social Security numbers, driver’s license and passport numbers, financial account information and medical information.
What This Means for Your Firm: Working out whose data was in the stolen files can take far longer than stopping the attack: here, about eight months. Knowing where participant data lives, and keeping less of it, shortens that review and the wait before clients hear from you.
The Pension Specialists, an independent retirement plan TPA, experienced a network disruption on February 24, 2024. Its investigation found that files may have been accessed or taken between February 18 and February 20, 2024. A review completed on December 16, 2024 found that personal information, including names and Social Security numbers, may have been exposed. Notices went to at least 71,443 people in February 2025, about a year after the attack, according to the firm’s filing with the Maine attorney general.
What This Means for Your Firm: Spotting the attack took days; working out whose data was involved took ten months. Mapping where participant data lives before an incident, and deleting what you no longer need, is what shortens that second clock.
Carruth Compliance Consulting administers 403(b) and 457(b) plans for many school districts. Its investigation found that personal information may have been taken from its network on or about December 21, 2024, and it notified client schools on January 13, 2025. At least 12 Oregon community colleges and school districts were affected. Names, Social Security numbers and financial account information may have been exposed.
What This Means for Your Firm: Public-sector Plan Sponsors often have stricter security requirements. Know your state breach notification laws and ensure your controls exceed minimum standards. Governmental 403(b) and 457(b) plans also sit outside ERISA — see what applies when ERISA doesn’t.
According to the firm’s filing with the Maine Attorney General, an external system intrusion occurred on April 29, 2026 and was discovered on May 1, 2026. The firm’s notice letter states that those affected were wealth management customers or applicants for, participants in, or alternate payees of retirement plans for which the firm provides services. Exposed data may have included names, addresses, Social Security numbers, financial account and bank account information, and dates of birth. Notices were mailed on May 29, 2026, with 24 months of identity monitoring offered.
What This Means for Your Firm: Discovery two days after the intrusion and notification within a month is the pattern regulators and plan sponsors now expect. Firms that combine retirement plan administration with other service lines should segment those environments so an incident in one does not expose participants of the other.
Retirement Clearinghouse, which helps move retirement savings from a former employer’s plan to a new one, found suspicious activity in one email account on March 15–16, 2023, and confirmed on March 28 that a phishing scheme may have exposed a small number of files. Those files held Social Security numbers and IRA account numbers for accounts at Matrix Trust Company.
What This Means for Your Firm: One clicked phishing link can expose thousands of participant records. Implement mandatory security awareness training, MFA on all accounts, and email filtering.
Between December 2024 and January 2025, a call center representative working for an outside vendor improperly accessed data on a limited number of retirement accounts at Inspira Financial (formerly Millennium Trust). The data may have included names, Social Security numbers, dates of birth and account numbers, types and balances. Inspira notified at least 2,308 participants in February 2025 and flagged their accounts for extra identity checks before any transaction.
What This Means for Your Firm: Not all threats come from external hackers. Implement principle of least privilege access controls and regular access reviews—especially for contractors.
Around August 31, 2024, an unauthorized actor took information from the network of Northwest Retirement Plan Consultants, a Washington firm that serves more than 800 local businesses. By January 15, 2025, it had confirmed that names, dates of birth and Social Security numbers may have been accessed. A class-action lawsuit followed, and in January 2026 a court granted preliminary approval of a $1.2 million settlement covering about 68,500 people. It offers up to $3,000 for documented losses or a $50 cash payment, plus three years of credit monitoring.
What This Means for Your Firm: Breach costs extend far beyond remediation. Legal fees, class action settlements, and regulatory penalties can threaten a TPA's viability. Proactive TPA IT security is cheaper than reactive crisis management.
Impact: About 1,300 retirement plan participants notified
On May 7, 2025, Transamerica was alerted to suspicious activity in a third-party, cloud-based application it used for client management. According to its notice, an unknown actor had gained access to the application through a call center “by pretending to be a Transamerica employee.” Letters to about 1,300 participants were dated June 26, 2025. A Massachusetts filing indicates that Social Security numbers and financial account information were involved. Transamerica said its internal network was not compromised and that it was not aware of any identity theft or fraud.
What This Means for Your Firm: Attackers do not always go after your own systems; here they talked their way into a vendor’s application. Help desks, yours and your vendors’, need a reliable way to verify who is calling before they grant or reset access.
DOL Elevates Cybersecurity to National Enforcement Project (January 2026)
On January 15, 2026, EBSA announced its national enforcement projects for fiscal year 2026, and cybersecurity is one of six priority areas, alongside mental health and substance use disorder benefits, benefit distributions, retirement asset management, surprise billing and criminal abuse of contributory plans. In September 2024, Compliance Assistance Release 2024-01 confirmed that the guidance applies to all ERISA-covered plans, including health and welfare plans — and its best practices have always been addressed to recordkeepers and other service providers, which includes TPAs. In FY 2025, EBSA recovered $1.4 billion for plans, participants and beneficiaries, including $714.4 million from its 878 closed civil investigations. TPAs without documented cybersecurity programs now face direct regulatory scrutiny.
Your Security Posture Is a Competitive Differentiator
Plan Sponsors are asking tougher questions. Auditors are scrutinizing IT controls more closely. The TPAs that thrive will be those that can demonstrate—not just claim—strong security practices.
Don't Wait for a Breach
Assess your vulnerabilities before your next audit or filing season.
