What Happens When Your CRM is Breached?

Even your client relationship management (CRM) software may not be safe from hackers. That’s the lesson some advisers are learning after an announcement by CRM vendor Redtail that it discovered in March 2019 that its cloud-based software had left some sensitive client data publicly accessible. The data left vulnerable included first names, last names, addresses, dates of birth, and Social Security numbers. Although Redtail has stated that it has subsequently removed such access, it remains to be seen whether any unauthorized access occurred during the time the data was left open to the public.

The SEC’s recent Risk Alert on Regulation S-P, issued in April 2019, highlighted that some advisers’ policies and procedures fail to address storage of personally identifiable information (PII) in a secure manner by third-party vendors and fail to identify all systems where the adviser is maintaining such PII.

If ever there was a crown jewel of investor data, an adviser’s CRM is a likely target – a treasure trove of the exact kind of information hackers find most valuable, all in a single location.

Redtail is allegedly still investigating, which reflects the inherent difficulty and the challenges vendors can face when attempting to discern the potential scope and impact of an incident. Logs become very critical to the investigation of what may or may not have been accessed and when. Conversely, the failure to maintain adequate logs can severely hamper efforts to piece together any indicators of compromise (IOC) surrounding a potential data incident.

Whether you use Redtail or another CRM, the chances are high that at least some of your client data is being stored in the cloud. Even Salesforce, a powerhouse in the CRM space, experienced an issue during a software update in June 2018 that temporarily made it possible for a programming API to allow one client to access another client’s data. It’s important to regularly review the information security safeguards your third-party vendors have in place as part of your ongoing vendor due diligence.  And, recognizing that most vendors will likely experience a security issue at some point given that there is no such thing as 100% security, use those due diligence reviews as an opportunity to inquire whether the issues have been remediated and whether there is any evidence that your firm’s data specifically was part of any detected unauthorized access.


For more information about how CSS cybersecurity services can help you evaluate your risk, please visit our Shield page or contact us. 


Subscribe to CSS Blog

CSS frequently publishes blog posts which are written by our team from their observations in the field, at conferences and through experiences with compliance professionals. These posts are designed to further knowledge and share industry best practices. Topics run the gamut, including Form ADV, cybersecurity, MiFID II, position limit monitoring, technology challenges and more. Complete and submit the brief form below to receive notifications when we publish new content.

Latest Content

Texas Outlaws and a Silver Bullet: Position Limits in the USA

In this first installment on position limits, Regulatory Guidance expert Greg Hotaling surveys the current landscape of position limits imposed for U.S.-listed commodity derivative holdings, which can affect investment firms and other speculative investors regardless of where they are based. Stay tuned for coverage of EU position limits in the next edition. “Who shot J.R.?!” … Continued

FAQs From the Cyber Desk

Cybersecurity is a fast-moving target, so it is not uncommon for firms to have questions when it comes to assessing and understanding their cybersecurity risks. Here at CSS we receive a lot of cybersecurity questions, so we thought we would take the time to answer 10 of the most common Frequently Asked Questions. (1) What … Continued

EU Position Limits: Born in the USA?

This is the second installment of Regulatory Guidance Expert Greg Hotaling’s blog on position limits, this time addressing EU-listed commodity derivatives and related products.  As always, keep in mind that these limits can apply to asset managers, and other market participants, regardless of where they are based. In 2009, the European Union’s first comprehensive position … Continued