PLANSPONSOR - April/May 2020 - 8

RULES & REGULATIONS
Another Plan Account Is Drained
A
new Employee Retirement
Income Security Act (ERISA)
complaint filed in the U.S.
District Court for the Northern District of
Illinois alleges a plan sponsor's retirement
plan service provider failed to use proper
defenses to protect a participant's account.
The complaint also alleges the plan
sponsor, Abbott Laboratories, failed to
monitor its provider's activities.
This is the second such lawsuit against
Alight Solutions and a sponsor client that
was filed after a participant's account was
hacked and large withdrawals were made.
The first reported lawsuit claimed a hacker
was able to take $99,000 from the account
of a former participant in the Estée Lauder
401(k) plan; this suit says $245,000 was
fraudulently withdrawn from the account
of a former participant in the Abbott
Corporate Benefits Stock Retirement Plan.
" Defendants failed to enforce a security
question routine set up for security
purposes on the defendants' website,
and instead simply provided a one-time
code over the phone that was used to loot
[the plaintiff's] account, " the complaint
states. " Then, rather than communicating
with [the plaintiff] via email concerning
changes to her account, as defendants
knew [she] preferred, they mailed notices,
allowing the theft to be consummated
and $245,000 to be transferred out of the
country via email to an Indian IP address
before [the plaintiff] could halt the fraud. "
Details from the text of the complaint
suggest the plaintiff shared her account
password with no one besides her
husband, who is the primary beneficiary
of the account assets, which totaled
over $360,000 before the alleged security
breach. The lawsuit details how the
hacker was able to use the " forgot password "
option to receive a code to get access
to the account. It says no online security
questions were asked.
The unknown user changed the
password and added to the account direct
deposit information for a SunTrust bank
account. " Two days later, on December
31, 2018, an unknown individual (the
'Impersonator') contacted the Abbott
Benefits Service Center, claiming to
be [the plaintiff], " the complaint states.
8 PLANSPONSOR.COM April - May 2020 Art by Mark Wang
" The Impersonator called from the phone
number ... which did not belong to [the
plaintiff], had never been used by [her] and
was not associated with [her] plan account.
The Impersonator told the customer
service representative that they had tried
to process a distribution online but was
unsuccessful. Defendants' customer
service representative, in a gross dereliction
of duty, asked the Impersonator if
they still lived at [the plaintiff's address],
thereby providing personal information to
the Impersonator, " the complaint states.
The plaintiff in the lawsuit says
she had selected email as her preferred
method of communication about transactions,
but instead she was sent a
letter about the withdrawal. The lawsuit
contends that if she had been notified by
her preferred method, she would have
received the notification sooner and
" would have been able to halt the transfer
and would have stopped the transfer. "
Alight strongly defended its cybersecurity
protocols. But the lawsuits serve
as a reminder to sponsors about their
responsibilities for plan cybersecurity.
http://www.PLANSPONSOR.COM
PLANSPONSOR - April/May 2020

Table of Contents for the Digital Edition of PLANSPONSOR - April/May 2020
