{"id":16270,"date":"2016-04-20T16:43:05","date_gmt":"2016-04-20T16:43:05","guid":{"rendered":"https:\/\/one.sightlinemg.com\/c4isrnet\/uncategorized\/2016\/04\/20\/fdic-waited-months-to-report-major-october-data-breach\/"},"modified":"2026-08-08T18:04:01","modified_gmt":"2026-08-08T18:04:01","slug":"fdic-waited-months-to-report-major-october-data-breach","status":"publish","type":"post","link":"https:\/\/one.sightlinemg.com\/c4isrnet\/cyber\/2016\/04\/20\/fdic-waited-months-to-report-major-october-data-breach\/","title":{"rendered":"FDIC waited months to report major October data breach"},"content":{"rendered":"\n

Officials at the Federal Deposit Insurance Corporation were reportedly\u00a0aware of a major leak of personally identifiable information (PII) late last year but failed to inform Congress for several months, according to internal FDIC documents obtained by Federal Times.<\/p>\n\n\n\n

In October 2015, a FDIC employee left the agency for a job in the private sector and took with her thousands of records containing highly sensitive information, including Social Security numbers, and <\/span>loan and banking information for American citizens,\u00a0according to a Feb. 19 report from FDIC Assistant Inspector General for Audits Mark Mulholland.<\/p>\n\n\n\n

An investigation showed the former employee downloaded files onto a personal portable hard drive on Sept. 16 and 17, and Oct. 15, including “Suspicious Activity Reports, Bank Currency Transaction Reports, [Bank Secrecy Act] Customer Data Reports and a small subset of personal work and tax files,” the report stated.<\/p>\n\n\n\n

Among those files were some 10,000 Social Security numbers.<\/p>\n\n\n\n

The exfiltration was discovered on Oct. 23 and referred to FDIC’s Computer Security Incident Response Team and later the Data Breach Management Team, which investigated the incident further, according to the IG report. DBMT classified the incident as a breach on Nov. 25 and, on Dec. 2, determined that a large number of Social Security numbers has been compromised.<\/p>\n\n\n\n

The FDIC reached out to the former employee’s lawyer on Dec. 2 requesting the portable drive be returned no later than Dec. 8, which it was.<\/p>\n\n\n\n

After a series of internal meetings, CIO Larry Gross and FDIC leadership reportedly decided the incident did not constitute a “major” breach as defined by the Office of Management and Budget and therefore was not required to be reported.<\/p>\n\n\n\n

During the IG’s investigation, Mulholland found the October incident did meet the threshold for a “major” designation and urged the CIO to report it to Congress by Dec. 9. He pointed to a stipulation under Federal Information Security Management Act that requires agencies to report such incidents to Congress within seven days after being labeled “major” and OMB memo M-16-03<\/a>, which outlines this process in detail.<\/p>\n\n\n\n

The OMB memo defines a “major” incident as one that involves classified or controlled unclassified information, is not easily recoverable, has a significant impact on the agency’s mission or meets a certain threshold based on the number or importance of records exfiltrated. The memo includes a decision matrix to help officials determine whether this definition applies in specific instances.<\/p>\n\n\n\n

“In our view, the incident should now be reported immediately,” Mulholland wrote in the report.<\/p>\n\n\n\n

Gross, who stepped into the CIO role<\/a> shortly after the incident occurred, agreed with the “breach” designation but “made a determination on behalf of the FDIC that the incident was not major,” according to the IG report.<\/p>\n\n\n\n

The CIO offered four reasons for rejecting the “major” designation:<\/p>\n\n\n\n