Cybersecurity Policy Report, Ongoing government shutdown increases data security concerns, (Nov 6, 2025)

By Colleen M. Svelnis, J.D.

As the federal government shutdown becomes the longest one in history, Democrats are highlighting concerns about Americans’ vulnerability to financial crime and information security.

As the federal government shutdown reaches 36 days, Representative Maxine Waters (D-Calif.), ranking member of the House Financial Services Committee, noted that it has now become the longest government shutdown in history, surpassing the 35-day shutdown that occurred during Trump’s first term.

Waters included the information in a committee release highlighting how the Administration’s attempts to dismantle the Consumer Financial Protection Bureau “have severely downgraded data security and left the agency’s information databases more vulnerable than ever before.”

“Throughout the shutdown, the Administration has devoted more energy to further undermining the agency and harming consumers than to reopening the government and providing relief to millions of American families,” Waters asserts.

On November 3, the Office of Inspector General for the CFPB released a report downgrading the Bureau’s cybersecurity program to a Level 2 maturity—the lowest overall rating since this rating model was adopted in 2017. The 2025 Audit Report of the Bureau’s Information Security Program concluded that procedures for securing its information systems have deteriorated, with the Bureau not maintaining authorizations to operate for many systems and using risk acceptance memorandums without a documented analysis of cybersecurity risks. The OIG noted that this issue has been “compounded by the loss of contractor resources supporting information security continuous monitoring and testing activities and the departure of agency personnel.” As such, the CFPB is “unable to maintain an effective level of awareness of security vulnerabilities in its environment,” according to the report (see Banking and Finance Law Daily, Nov. 4, 2025)).

The Bureau maintains sensitive and confidential data from investigations, the oversight of thousands of financial companies, and complaints received from millions of consumers. A Level 2 rating on this 1-5 rating scale, where 1 is the worst and 5 is the best, “means that the agency is now failing to adequately safeguard Americans’ sensitive data,” warns Waters. The release also cautions that the CFPB’s weakened cyber defenses could allow hackers or other bad actors to get a treasure trove of sensitive information about our financial businesses and consumers through the back door.

During this year, the administration has taken the following actions against the CFPB:

1. mass firing of staff;

2. massive funding cuts;

3. stop-work orders and dropped pro-consumer enforcement actions; and

4. rescinding rules and guidance.

The committee’s release notes that the last time the CFPB was rated poorly on information security was during Trump’s first term, when the administration first sought to undermine the Bureau in a variety of ways. “This latest Inspector General report makes clear that the firing of CFPB staff and contractors has further compromised consumer safety.”

LegislativeActivity: CFPB CrimesOffenses CyberPrivacyFeed DataPrivacy DataSecurity FinancialStability FinTech OversightInvestigations Privacy