Federal Reserve OIG Exposes Critical Offboarding Security Failures
The Federal Reserve's watchdog found systemic governance failures allowed an employee to remove sensitive FOMC data before retirement.
The Federal Reserve's Office of Inspector General issued a management alert citing critical weaknesses in the board’s ability to detect and respond to information removal by exiting employees. The OIG acted before completing a planned audit due to concerns about the Board’s handling of a 2024 information security situation involving a departing employee and sensitive Federal Open Market Committee data.
Employee’s pattern of unauthorized data transfers precedes retirement
In the months leading to retirement, the employee triggered hundreds of data loss prevention alerts. Activities included printing, copying data to a notepad application, sending potentially sensitive information to personal email addresses, and transferring files to an unencrypted USB device. The OIG report found the employee triggered 279 data loss prevention alerts before retiring in July 2024.
| Alert Metric | Figure |
|---|---|
| Total DLP alerts triggered | 279 |
| Alerts flagged as potentially involving sensitive FOMC classified information | 111 |
| Alerts occurring in June 2024 | 227 |
| Alerts three days prior to employee's personal trip to a restricted country | 192 |
The employee had announced plans to retire in February 2024. The information incident began shortly before June 2024 travel to a country designated as restricted by the Fed Board, which the international finance division was unaware of, and continued past the employee’s retirement that July.
This was part of an ongoing pattern. In 2021, the employee copied sensitive FOMC classified information to an unencrypted USB device, claiming a mistaken belief it was encrypted. Later in 2023, the employee attempted to send similar information to a personal email account, calling it inadvertent. Despite counseling on using encrypted devices, the employee engaged in similar unauthorized transfers before retiring without supervisor review. The international finance division’s technology team accepted explanations that alerts were false positives and files were publicly available without reviewing the files themselves.
The OIG stated the employee’s ongoing pattern of potential and confirmed security violations, imminent departure, and multiple insider threat risk indicators signaled the possibility that a credible insider threat incident and potential material information security breach had occurred.
Systemic failures in offboarding and incident response identified
The OIG found a collective lack of action across multiple divisions. Limited follow-up did not match the accumulated risks. Conflicting understanding of escalation and resolution responsibilities among groups contributed to the incident remaining unresolved for over a year. The OIG learned of the information incident in July 2025, one year after the employee retired.
The review found the Fed’s response insufficient, its policies for responding to information removal inadequate, and noted the Board did not escalate the potential incident as it should have. While there was insufficient basis to pursue a misconduct investigation for the 2024 incident due to many false-positive alerts, it highlighted systemic offboarding process concerns. The governance of the information security program and enforcement of controls lack clarity. The OIG concluded the incident highlighted systemic concerns about the offboarding process and information security control breakdowns.
Fed commits to reforms but timelines extend to 2027
Senior Fed leaders concurred with the OIG’s recommendations to strengthen the Board’s governance of its information security program and enforcement of its controls. They stated the Board takes these matters seriously and plans to promptly take all required steps to implement all recommendations, with several already underway.
The OIG had warned that without fixes, process weaknesses would persist, undermining the Board’s information security program and increasing the risk of a major breach. It provided nine recommendations to safeguard sensitive information during employee offboarding, all agreed to by management.
The Board plans to implement processes and protocols to define roles and responsibilities and strengthen escalation alerts by the first quarter of 2027. It intends to create enhanced monitoring and escalation protocols via a new data loss prevention solution by the third quarter of 2027.
