Redtail response to investor data leak may have broken state laws

Redtail Technology may have broken state cybersecurity regulations with its response to leaked investor personal identifying information.

The fintech firm waited more than two months after first detecting an internal error that publicly exposed investor names, physical addresses, dates of birth and Social Security numbers to the internet. Redtail, which sells client relationship management software, said it discovered and repaired the breach on March 4, but it didn’t start notifying impacted investors until May 17.

All 50 states now have regulations requiring companies to notify customers when their personal data is compromised, said Sara Jodka, a cybersecurity and data privacy attorney with Dickinson Wright.

(Disclosure: Ms. Jodka represents other CRM companies, but none in the financial sector that compete with Redtail.)

Ohio requires companies to notify users within 45 days of learning about the breach, Ms. Jodka said. Florida’s limit is 30 days.

Most states, even those with the strictest regulations, require firms to publicly disclose a breach as soon as is reasonable, but Redtail might not meet that standard in some regulators’ eyes.

(More: Cybersecurity concerns over messaging apps grow as more firms enable adviser texting)

“Normally, two months is not going to be unreasonable, but it is odd in this [case] because it’s an internal issue,” Ms. Jodka said. “You’re not dealing with a nefarious outside force.”

Redtail addressed the timing issue in its letter to advisers. The firm said the nature and format of the data required extra time to investigate and identify which individuals were affected. Redtail said it had to build new applications for the task.

“That sounds right,” said Ms. Jodka, adding that determining which data were exposed is never an easy task. “Whenever you get into doing forensics, it takes you down the path of crumbs and what databases might have been affected.”

But Redtail’s reason might not be good enough for Massachusetts regulators. The state amended its data breach notification law in January to specifically state that companies cannot delay notification “on the grounds that the total number of residents affected is not yet ascertained.”

Even just from a best-practices standpoint, two months is an unusually long time, said Bart McDonough, CEO and founder of Agio, a cybersecurity and managed IT provider.

“What I would say is this highlights the need for not only the systems to detect these issues, but the processes to be able to respond in a more timely manner,” Mr. McDonough said.

He recommended that adviser and fintech firms engage in exercises to test and practice their data breach response plans.

It’s also unusual for a business-to-business technology like Redtail to directly inform impacted investors. Clients typically don’t interact directly with a CRM, and most probably don’t know what Redtail is, Mr. McDonough said.

(More: 10 trends in cybersecurity you need to know)

In its letter to advisers, Redtail said it’s emailing affected investors and offering free access to LifeLock Defender Preferred, a credit and identity theft monitoring and remediation product from Symantec.

“It’s improper for them to contact the end investor,” he added.

Redtail did not respond to a request for comment.