After security testing, CFPB to resume collecting consumer data

Acting agency director Mick Mulvaney said the bureau is safe to resume collection after an "exhaustive" security review.

After an “exhaustive” review of the agency’s security practices, the Consumer Financial Protection Bureau will resume collecting consumers’ personal data, acting agency director Mick Mulvaney told employees Thursday.

An independent security assessment “concluded that ‘externally facing bureau systems appear to be well-secured,’” Mulvaney said.

CFPB has a mandate to collect consumer data on things like credit cards and mortgages. The agency’s cybersecurity practices drew the scrutiny of lawmakers in April, when Mulvaney told the Senate Committee on Banking, Housing, and Urban Affairs that the agency had suffered roughly 240 data security breaches and 800 suspected breaches. An CFPB spokesperson told CyberScoop the breaches of personally identifiable information happened before Mulvaney took the agency’s helm in November 2017.

“When I first arrived at the bureau, I was concerned that the information the bureau collects about consumers could fall prey to hackers or other actors,” Mulvaney said in an email to agency staff obtained by CyberScoop.

Mulvaney put a hold on the sensitive data collection shortly thereafter. A subsequent assessment by outside experts included “white-hat hacking” and made recommendations to boost security, Mulvaney said. Some CFPB employees opened phishing emails sent by the security testers, according to Mulvaney. “Therefore, we will step up our employee and contractor training on how to detect and deal with suspicious emails.”

A CFPB spokesperson told CyberScoop that for security reasons, the bureau is not publicly disclosing the specific details and findings of the third-party security review.

Sen. David Perdue, R-Ga., a member of the Senate Committee on Banking, Housing, and Urban Affairs, has requested a confidential briefing from Mulvaney on the data breaches. That briefing has yet to take place, according to Perdue’s office.

You can read the full email below.

[documentcloud url=”http://www.documentcloud.org/documents/4492312-Data-Collection-Memo.html” responsive=true]

Government

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure