CFPB Can't Confirm Safety of Abandoned Office Kit
The US Consumer Financial Protection Bureau (CFPB) left IT equipment behind when it shut four regional offices in early 2025. The bureau cannot confirm if the data on this equipment is secure, as reported by Bloomberg in an audit issued by its inspector general.
Key Findings:
- The CFPB ended leases on offices in New York, Chicago, San Francisco, and Atlanta in early 2025.
- They left behind technology, including hardware with potential sensitive data like consumer complaints, financial details, and supervisory records.
- The bureau had no way of knowing if anyone accessed or tampered with the equipment or its data.
Timeline of Events:
- The General Services Administration (GSA) handled physical security of the offices after lease endings in February 2025.
- The CFPB stopped paying for network links in September 2025, but still had not fully vacated the premises by March 2026.
- Auditors found no approved plan or timeline due to litigation and travel approvals issues.
CFPB Response:
The CFPB agreed to secure all equipment but rejected claims of heightened data breach risk in a September 18 letter. They stated that the kit was mainly used for networks, internet access, and admin work, with no databases containing sensitive data housed in regional offices.
Consequences of Office Closures:
- The CFPB has scaled back oversight of banks and lenders, dropping enforcement cases worth hundreds of millions of dollars.
- Administration plans to cut half of its remaining 1,100 staff.
- States have stepped in to fill the regulatory gap, as seen with the July settlement between 46 states and Block over Cash App fraud claims.