Redtail response to investor data leak may have broken state laws

Redtail response to investor data leak may have broken state laws
Fintech firm waited two months to tell investors after finding and fixing the breach.
MAY 24, 2019

Redtail Technology may have broken state cybersecurity regulations with its response to leaked investor personal identifying information. The fintech firm waited more than two months after first detecting an internal error that publicly exposed investor names, physical addresses, dates of birth and Social Security numbers to the internet. Redtail, which sells client relationship management software, said it discovered and repaired the breach on March 4, but it didn't start notifying impacted investors until May 17. All 50 states now have regulations requiring companies to notify customers when their personal data is compromised, said Sara Jodka, a cybersecurity and data privacy attorney with Dickinson Wright. (Disclosure: Ms. Jodka represents other CRM companies, but none in the financial sector that compete with Redtail.) Ohio requires companies to notify users within 45 days of learning about the breach, Ms. Jodka said. Florida's limit is 30 days. Most states, even those with the strictest regulations, require firms to publicly disclose a breach as soon as is reasonable, but Redtail might not meet that standard in some regulators' eyes. (More: Cybersecurity concerns over messaging apps grow as more firms enable adviser texting) "Normally, two months is not going to be unreasonable, but it is odd in this [case] because it's an internal issue," Ms. Jodka said. "You're not dealing with a nefarious outside force." Redtail addressed the timing issue in its letter to advisers. The firm said the nature and format of the data required extra time to investigate and identify which individuals were affected. Redtail said it had to build new applications for the task. "That sounds right," said Ms. Jodka, adding that determining which data were exposed is never an easy task. "Whenever you get into doing forensics, it takes you down the path of crumbs and what databases might have been affected." But Redtail's reason might not be good enough for Massachusetts regulators. The state amended its data breach notification law in January to specifically state that companies cannot delay notification "on the grounds that the total number of residents affected is not yet ascertained." Even just from a best-practices standpoint, two months is an unusually long time, said Bart McDonough, CEO and founder of Agio, a cybersecurity and managed IT provider. "What I would say is this highlights the need for not only the systems to detect these issues, but the processes to be able to respond in a more timely manner," Mr. McDonough said. He recommended that adviser and fintech firms engage in exercises to test and practice their data breach response plans. It's also unusual for a business-to-business technology like Redtail to directly inform impacted investors. Clients typically don't interact directly with a CRM, and most probably don't know what Redtail is, Mr. McDonough said. (More: 10 trends in cybersecurity you need to know) In its letter to advisers, Redtail said it's emailing affected investors and offering free access to LifeLock Defender Preferred, a credit and identity theft monitoring and remediation product from Symantec. "It's improper for them to contact the end investor," he added. Redtail did not respond to a request for comment.

Latest News

SEC Says Game Service Roblox Part of ‘Active Investigation’
SEC Says Game Service Roblox Part of ‘Active Investigation’

Short sellers previously said the company was under investigation, though Roblox denied allegations.

Musk’s DOGE descends on CFPB with intention to shut it down
Musk’s DOGE descends on CFPB with intention to shut it down

The Consumer Financial Protection Bureau is in the crosshairs of the Republican group that is widely attempting to dismantle government agencies.

Advisor fighting Finra banishment loses $17.7 million dispute with old firm
Advisor fighting Finra banishment loses $17.7 million dispute with old firm

National Securities Corp. sued the advisor in 2020, alleging breach of contract and unjust enrichment.

Job numbers, inflation leaving room for Fed to hold rates
Job numbers, inflation leaving room for Fed to hold rates

Recent data support a measured pace by the Federal Reserve for the year ahead.

Private assets remain hot despite surging stock market
Private assets remain hot despite surging stock market

Financial advisors are still adding alternatives despite the surge in publicly traded stock prices

SPONSORED Taylor Matthews on what's behind Farther's rapid growth

From 'no clients' to reshaping wealth management, Farther blends tech and trust to deliver family-office experience at scale.

SPONSORED Why wealth advisors should care about the future of federal tax policy

Blue Vault features expert strategies to harness for maximum client advantage.