BENEFITS DIGEST

The SEC’s examination priorities for 2027 put private-market access, conflicts of interest, cybersecurity and evolving technology on the supervisory agenda. Practitioners quoted in the article read the list as a signal for advisers serving retail investors, including retirement savers moving into less liquid investments. Examination priorities direct the staff’s attention and don’t create new duties by themselves. Advisers and the committees that hire them can use the list to anticipate what examiners will ask about.

Labcorp’s $2,287,455 multistate settlement grew out of a data breach at a debt-collection vendor. Holland & Knight’s Shannon Britton Hartsfield describes the settlement agreement as imposing security governance, vendor oversight and independent assessment obligations without an admission of liability. Benefits professionals who route health information through service providers can read the described requirements as a diligence checklist. The settlement binds Labcorp, not every plan.

Ary Rosenbaum recommends a standing yearly meeting devoted to how the retirement plan is actually operating, with an agenda spanning service providers, participant concerns, errors, cybersecurity, plan design, and who is responsible for what, memorialized in written minutes. ERISA does not require an annual meeting, and he does not claim otherwise. The minutes are the quiet payoff, since they preserve the reasons for decisions that get questioned years later.

Cyber insurers at the NetDiligence summit say most losses still come from familiar ransomware and human error rather than exotic AI attacks, which keeps the basics decisive, multifactor authentication, network segmentation, employee training, and monitoring that someone actually watches. For benefits teams the relevance is direct, since plan data and vendor connections are exactly the kind of target these controls protect, and carriers increasingly price coverage on their presence.

In a new WatchBlog post, the Government Accountability Office revisits its recommendation that the Labor Secretary provide guidance on participant data privacy for plan sponsors and service providers.

Review of 31 retirement plan service providers finds few explicitly restrict participant data sharing for marketing, prompting GAO to call for stronger DOL privacy guidance.

Learn why cybersecurity now belongs in the boardroom and what public pension trustees should be asking about governance.

A May cyberattack on DentaQuest, the dental and vision benefits administrator serving 32 million Americans, compromised the health data of at least 15 million individuals, the largest health data breach reported to federal regulators this year. Plan sponsors whose group plans use DentaQuest should be reviewing their business associate agreements and notification obligations.

The security press take from late July: the ShinyHunters extortion group claimed responsibility for the May intrusion, stealing 234 GB of data after ransom negotiations failed, with files dating back to 2009 and a final assessment above 23.4 million people, well past the 15 million in initial reports.

Experts say participants, recordkeepers and plan sponsors share responsibilities in making participants whole after experiencing a loss.

Bessemer System Federal Credit Union sued TruStage Financial Group days after a cybersecurity incident forced TruStage, which serves 93% of U.S. credit unions, to shut down its systems and lock members out of 401(k) plans. The suit is an early test of whether institutional clients can hold a vendor liable for cybersecurity failures based on operational disruption alone, without proof that data was actually stolen.

Ari Sonneberg and Barry Salkin propose a federal insurance backstop for defined contribution plan cybersecurity losses, building on the DOL's January 2026 enforcement policy naming cybersecurity and data protection as its highest priority. A thought piece, but a timely one given plan sponsors' growing exposure to participant account theft.

In its January 2026 statement of enforcement policy, the Department of Labor (“DOL”) indicated that cybersecurity and data protection were its highest priority.

Tom Hawkins explains the logic behind Retirement Clearinghouse’s newly updated missing participant policy template