CFPB can’t say if data on abandoned office kit is safe, watchdog finds

The bureau ended the leases on its New York, Chicago, San Francisco and Atlanta offices in early 2025. It left technology behind, and still cannot confirm that the kit, or any data on it, is secure.

The inspector general for the Federal Reserve Board and the CFPB issued the warning as an urgent management alert on Wednesday. It found the problem during its yearly cybersecurity audit.

The CFPB has “no way of knowing” whether anyone accessed, changed or took the hardware or any sensitive data on it, the report said.

The kit could hold consumer complaints, sensitive financial details and confidential supervisory records, the watchdog warned.

A year and a half of drift

The CFPB rented the offices from the General Services Administration, which took over their physical security when the leases ended in February 2025. The bureau stopped paying for the offices’ network links that September.

By March 2026, it still had not fully moved out. In June, officials told auditors no one had checked the equipment. In September, they said there was still no approved plan or timeline, citing litigation and travel approvals.

The bureau pushes back

The CFPB agreed to find and secure all the equipment. But it rejected the idea that it faces a higher risk of a data breach, in a letter dated 18 September.

“No databases containing sensitive data are housed in the regional offices,” wrote chief information officer Christopher Chilbert.

He said the kit was mainly used for networks, internet access and admin work. The bureau has started clearing out the IT at each former office, one site at a time, and aimed to finish by 30 September.

An agency cut to the bone

The office closures were ordered by Russell Vought, who was running the bureau at the time. Staff were told to stop work and stay home in February 2025, soon after Donald Trump returned to office.

Since then, the CFPB has scaled back its oversight of banks and lenders and dropped enforcement cases worth hundreds of millions of dollars. The administration plans to cut half of its remaining 1,100 staff, Bloomberg reported.

States have tried to fill the gap. In July, 46 states settled with Block over Cash App fraud claims, a type of case the bureau once led.