Department of Labor prioritizes cybersecurity for employee benefit plans

The Department of Labor’s Employee Benefits Security Administration (EBSA) has designated cybersecurity as its top enforcement priority for employee benefit plans as of January 2026.

Retirement plan sponsors face increasing fiduciary obligations regarding data protection. As plans increasingly rely on recordkeeper websites, participant apps, and AI-driven tools, more sensitive information—including Social Security numbers, account balances, and bank details—is being processed through various third-party vendors.

Plan sponsors are responsible for the oversight of these providers. Experts recommend that when hiring or reviewing recordkeepers and third-party administrators, sponsors should evaluate encryption methods, data protection protocols, and breach notification speeds. Additionally, educating participants on identifying scams remains a critical component of plan security.