The Human Factor: Why TPA Breaches Start with People

The Data Is Clear

According to the Verizon 2026 Data Breach Investigations Report — drawn from more than 31,000 security incidents and over 22,000 confirmed breaches — the human element (non-malicious human actions such as mistakes, falling for social engineering and the use of stolen credentials) is involved in 62% of all data breaches, up from 60% the prior year. The mix of initial access has shifted sharply: exploitation of vulnerabilities is now the leading vector at 31% of breaches, while abuse of stolen credentials fell to 13%. Ransomware featured in 48% of breaches, up from 44%.

For TPAs, these statistics aren't abstract. You hold Social Security numbers, dates of birth, bank account details, and financial data for thousands — sometimes tens of thousands — of retirement plan participants. Every one of those records has value on the dark web, and your staff communicates constantly with plan sponsors, recordkeepers, payroll providers, and participants — creating multiple entry points for social engineering attacks.

Why TPAs Are Prime Targets

Small-to-mid-sized TPA firms face a particular challenge. They hold enterprise-grade sensitive data but often lack enterprise-grade security training budgets. Staff turnover means new employees who haven't been trained. Busy compliance seasons mean distracted employees more likely to click without thinking. And the nature of TPA work — constant communication with external parties — makes phishing emails harder to distinguish from legitimate requests.

Consider the Transamerica incident in May 2025. According to the company’s notice, an unknown actor gained access to a third-party application Transamerica used for client management through a call center, “by pretending to be a Transamerica employee.” The way in was a person, not a software flaw. About 1,300 participants were notified, and Transamerica said it was not aware of any identity theft or fraud. (Details and source.)

DOL Expects You to Address This

DOL’s Best Practice #7 calls for cybersecurity awareness training “conducted at least annually for all personnel,” updated for the risks found in the latest risk assessment, and it names identity theft and fraudulent distributions as key topics. A single annual session meets the letter of that, but AI-generated phishing emails are becoming nearly indistinguishable from legitimate messages, and once a year is no longer enough on its own when the threat landscape changes monthly.

The question isn't whether your team will be targeted by a phishing attempt. It's whether they'll recognize it when it happens.

What Effective TPA Security Training Looks Like

Effective security awareness for TPAs goes beyond generic corporate training videos. It needs to address TPA-specific scenarios: fraudulent distribution requests that impersonate plan sponsors, emails that appear to come from recordkeepers requesting login credentials, impersonation of participants requesting account changes, and social engineering targeting year-end processing when staff are rushing to meet deadlines.

Training also needs to be continuous, not annual. Monthly phishing simulations test real-world readiness. Quarterly training sessions address emerging threats. Failed simulation attempts trigger immediate remediation. Completion rates and improvement trends are documented — providing the evidence DOL auditors look for.

How TPAIT Approaches the Human Factor

TPAIT deploys ongoing security awareness training tailored to TPA operations. Monthly phishing simulations use scenarios relevant to retirement plan administration. Quarterly training addresses current threat intelligence. We track completion rates, click rates, and improvement over time — giving you documented evidence of employee training for plan sponsor questionnaires and DOL audits. Your team becomes your strongest defensive layer instead of your biggest vulnerability.

Learn more about our full cybersecurity approach on our Cybersecurity Services page.