The US Consumer Financial Protection Bureau faces scrutiny after failing to secure information technology equipment left behind during the closure of four regional offices in early 2025. An audit by the Federal Reserve Board's inspector general, reported by J.J. McCorvey for Bloomberg, has raised alarms about the agency's inability to verify the safety of hardware and data housed in its former New York, Chicago, San Francisco and Atlanta locations.

The watchdog issued an urgent management alert on Wednesday following its annual cybersecurity review. The equipment abandoned at these sites could potentially contain consumer complaints, sensitive financial information and confidential supervisory records, according to the findings.

The CFPB has "no way of knowing" whether anyone accessed, changed or took the hardware or any sensitive data on it, the report said.

A year and a half of drift

The General Services Administration assumed responsibility for physical security of the four offices when the CFPB's leases expired in February 2025. The agency discontinued payment for network connectivity at these locations in September of that year.

By March 2026, the bureau had still not completed its exit from the facilities. When auditors checked in June, officials acknowledged that no one had inspected the equipment. By September, the agency reported having neither an approved removal plan nor a completion timeline, citing ongoing litigation and travel authorization delays.

The bureau pushes back

The CFPB committed to locating and securing all remaining equipment but disputed the auditors' assessment of breach risk in a September 18 response letter.

"No databases containing sensitive data are housed in the regional offices," wrote chief information officer Christopher Chilbert.

Christopher Chilbert, CFPB chief information officer

Chilbert characterized the hardware as primarily supporting network infrastructure, internet connectivity and administrative functions. The bureau initiated a phased retrieval process across the former offices, targeting completion by September 30.

An agency cut to the bone

Russell Vought, who led the CFPB at the time, ordered the office closures. In February 2025, shortly after Donald Trump took office, employees received instructions to cease work and remain home.

The CFPB has subsequently reduced its regulatory oversight of financial institutions and lenders and abandoned enforcement actions valued at hundreds of millions of dollars. According to Bloomberg, the administration intends to eliminate half of the agency's remaining 1,100 positions.

State governments have begun stepping into the enforcement void. In July, 46 states reached a settlement with Block regarding Cash App fraud allegations—a category of enforcement action the federal bureau previously spearheaded.

Source: The Next Web