On September 30, the OIG for the Fed and the CFPB issued a management alert finding that the CFPB left hardware assets at four former regional offices in New York, Chicago, San Francisco and Atlanta without confirming that the equipment remained secure. The OIG flagged the issue partway through its 2026 audit under the Federal Information Security Modernization Act of 2014, saying the risk required the CFPB’s “immediate attention.” Although the General Services Administration took over physical security of the offices after the agencies agreed in February 2025 to terminate the leases, the CFPB kept ownership of and responsibility for the IT equipment left behind. As of the report’s release, the CFPB had neither approved a plan nor set a timeline to check on the equipment, pointing to pending litigation and the lack of authorization for staff travel to the sites. The OIG noted that, with the equipment left at the sites for more than 18 months, the CFPB had “no way of knowing” whether unauthorized individuals have accessed, altered or taken the equipment or any data on it, which the report said may include consumer complaint information, sensitive financial information and confidential supervisory records.

The OIG recommended that the CFPB’s chief information officer account for and secure the equipment. The CFPB concurred, saying it had started decommissioning the IT at each office and expected to finish by September 30. The CFPB also disputed the alert’s characterization of the assets, saying the regional equipment primarily supported infrastructure, network access and administrative functions, and that none of the offices held databases with sensitive information.