Sensitive-data lapse at SEC intensifies calls to strip CAT of retail investor identifiers

An industry group representing broker-dealers and financial advisors is pressing the Securities and Exchange Commission to move faster on stripping retail investors' personal data out of the Consolidated Audit Trail, pointing to a newly released internal watchdog report as proof the system remains vulnerable.

The American Securities Association said the findings from the SEC's Office of Inspector General confirm what it has been telling regulators for years: that giving thousands of people access to a database packed with sensitive financial and personal information is a breach waiting to happen.

"This breach is exactly what ASA has been warning about for years, and it should never have been allowed to happen in the first place," said ASA president and CEO Chris Iacovella. "When thousands of people have access to sensitive financial and personal data, it is not a matter of if there will be a breach, it is a matter of when. The CAT Customer and Account Information Data identifier is not a technical workaround that solves the personal data problem, it is the problem, and it is time for the SEC to stop using retail investors' personal and financial information to track them around our markets."

The OIG investigation centered on a since-retired SEC staffer who tapped into the Division of Enforcement's case management system from home without authorization or any legitimate need, looking at details tied to an active investigation on more than one occasion.

According to the watchdog's findings, the employee let her adult son view the material while she left the room, telling investigators she wanted to demonstrate to him that the agency had a live case into the matter. She also accessed a second, related investigation she had no authority to view.

The son subsequently posted a screenshot of the case management system, showing non-public details of the investigation, on X. He went on to send further images of the SEC-issued laptop through direct messages on the platform, one of which included the contact details of an SEC employee assigned to the case. The image first appeared online on May 10, 2025.

The OIG referred its findings to the US Attorney for the District of Columbia, which declined to bring charges against either the former employee or her son.

CAT exposure

While the OIG investigation involved the SEC's internal case management database rather than the Consolidated Audit Trail itself, ASA argues the episode illustrates a broader structural flaw across SEC data systems rather than a one-off lapse.

The audit trail system must be able to handle at least 3,000 concurrent users, spanning Commission staff, self-regulatory organization personnel, plan processor employees and outside contractors, with each user able to reach records of every trade, in every account, from every broker, tied to every retail investor in the country.

The group contends that the CCID identifier compounds the risk by linking each of those downloads to a permanent, searchable trading history for individual investors, effectively building an extensive surveillance profile that becomes more exposed with each new security failure.

The association is calling on the SEC to immediately halt collection and use of retail investors' personally identifiable information, discontinue individual customer identifiers altogether, commission an emergency independent cybersecurity audit, and work with lawmakers to pass the Protecting Investors' Personally Identifiable Information Act.

ASA said the OIG's report shows regulators can no longer treat the current setup as adequate, and that continued inaction leaves American investors exposed.