Many people consider their 401(k) a safety net. But what happens if that safety net gets hacked? Here’s what to look out for and how to monitor your 401(k) plan.
Millions of Americans count on employer-sponsored retirement savings plans, such as 401(k)s, to help them retire comfortably.
If you’re among them, you may have shared highly sensitive details — like your Social Security number or bank account number — with plan providers and administrators during the enrollment process.
But do you know what happens to that information once it’s collected?
Unfortunately, it’s not always stored as carefully as it should be.
A 2021 federal watchdog report from the Government Accountability Office (GAO) found “significant cybersecurity risks” in how plan providers and administrators handle participant data, putting retirement plan holders’ privacy and life savings at risk.
The threat of cyberattacks to retirement plans
With more than $7 trillion in assets, 401(k) plans are an attractive target for cybercriminals.
And these days, retirement plans are mostly managed online, with plan providers and administrators sharing and storing participant data digitally. Unfortunately, without proper cybersecurity measures in place, this can up the risk of exposure.
While there’s no public data available on how many 401(k) accounts have been compromised, it’s common knowledge that bad actors can use personal details to unlock financial accounts.
In recent years, retirement account holders have made a number of legal claims about unauthorized activity. For example, in 2022, a former Colgate-Palmolive employee sued her 401(k) plan’s fiduciaries after a cybercriminal stole more than $750,000 from her account.
The GAO says more federal guidance is required to mitigate the risk of additional compromises.
Protecting your retirement savings
Government regulations
There are existing regulations designed to offer some protection for retirement savings. For example, the Gramm-Leach-Bliley Act requires financial institutions to safeguard sensitive data.
But some of the third parties involved with retirement accounts — such as payroll providers — aren’t financial institutions and may not be held to the same rules.
In 2021, the Department of Labor (DOL) announced new cybersecurity guidance for retirement plan sponsors and fiduciaries governed by the Employee Retirement Income Security Act.
However, the GAO recommends the DOL go further by issuing additional guidance on how personal data should be handled by all of the entities involved in administering employer-sponsored retirement plans, including those that aren’t fiduciaries.
Tips for 401(k) plan holders
If you’re looking to reduce the risk of fraud to your retirement account, our basic online security tips are a great place to start.
Simply put, you should protect your retirement account the same way you protect your day-to-day checking or savings account, by following these simple precautions:
Regularly monitor for any unauthorized transactions
Always use a secure connection when accessing your account
Cybersecurity best practices for 401(k) accounts
Make sure you have online access to your retirement account, so you can constantly monitor and protect it.
Update your account contact information when it changes, so you can be reached quickly if there’s a problem.
Stay alert to impersonation scams and be cautious whenever you receive an unexpected or urgent call or text from someone claiming to be your 401(k) provider.
If you're an Allstate Identity Protection member and want to get even more protection, connect your 401(k) for monitoring in the "Financial Transactions" tab on your account dashboard.
Our alerts let you know when something’s up, so you can act quickly to protect your nest egg. If an issue does arise, support is available 24/7.
If you’re not a member, check if your employer offers Allstate Identity Protection or sign up today — so you can face the future with confidence.
