PLANSPONSOR - August/September 2020 - 6

RULES & REGULATIONS
Sponsors Can Hack-Proof Their Plan
A
recent court ruling over the
safeguarding of private 401(k)
accounts against fraudulent
payouts is putting all account holders,
plan sponsors and plan administrators
equally on notice that, in the event of a
cyberhack or -breach, all parties could
potentially be liable.
In the case Leventhal v. MandMarblestone
Group LLC, the Eastern
District Court of Pennsylvania ruled in
May that 401(k) plan sponsors-viz.,
employers-can be held equally liable with
third-party outsourcers that administer the
plan when such accounts are breached.
This is especially true when the employer
has inadequate security defenses or if
affected plan participants work remotely or
have not been given adequate safeguards.
Indeed, robust cybersecurity for such
accounts is especially important during
the pandemic, following the passage of
the Coronavirus, Aid, Relief and Economic
Security (CARES) Act in March. Aimed at
helping out-of-work Americans get immediate
access to critical funds, the legislation
makes it easier to take early retirement
plan distributions. But it can also make it
easier for cybercrooks to do the same.
" The heightened level of plan distributions
coupled with the security risks associated
with electronic communications
and the 'new normal' of working remotely,
sometimes on personal computers, may
increase the exposure of participants'
confidential and personal data to cybercriminals, "
says Jeffrey D. Mamorsky,
co-chairman of the global human capital
and compensation and benefit groups at
Greenberg Traurig in New York City.
Cyberattacks against defined contribution
(DC) plan accounts have been on
the rise for the past couple of years, but
especially so in the past several months.
Consider two of the more notable cases.
A former employee of Estée Lauder
Inc. sued the cosmetics firm and its plan
administrator, Alight Solutions LLC, when
6 PLANSPONSOR.COM August - September 2020 Art by Giulia Sagramola
she discovered that three distributions were
made from her plan account-of $37,000,
$52,000 and $12,000, for a total of approximately
$100,000-without her knowledge
or consent. The former employee claimed
the firms breached their fiduciary duty by
failing to secure and protect her account.
In another case, a woman from
Massachusetts had nearly $200,000
drained from her retirement account
when a hacker attached a fraudulent bank
account to her 401(k) plan and also infiltrated
her email account, thus intercepting
the notice of the change in bank access.
The woman never learned of the distributions
from her account until it was too late.
" Security is only as good as its weakest
link, and there are myriad ways to carry out
a cyberattack, " notes Kate Black, with the
data, privacy and cybersecurity group at
Greenberg Taurig in Miami. " For example,
if a user sets a password to their 401(k)
account that they have reused on other
websites, which is very common, it's likely
http://www.PLANSPONSOR.COM
PLANSPONSOR - August/September 2020

Table of Contents for the Digital Edition of PLANSPONSOR - August/September 2020
