Fed insider made 3 attempts to exfiltrate FOMC files via USB

For security teams, the Federal Reserve report is a textbook insider-threat timeline: an employee with privileged FOMC access triggered three data-loss-prevention alerts over two years—an unencrypted USB copy in 2021, a personal-email attempt in 2023, and a second USB copy later that year—yet still retired normally in July 2024. The IG’s admission that many alerts were false positives and that records couldn’t show what was removed highlights the hard reality of alert fatigue and forensic blind spots in high-stakes environments.

The Federal Reserve’s Office of Inspector General has put the central bank on notice over a potential insider-data incident that never became a formal misconduct case but exposes gaps in how the Fed handles employees leaving with access to confidential policymaking material. In a report dated September 28, 2026, the IG described a retiring staff member in the Division of International Finance who was flagged on at least three separate occasions between 2021 and 2023 for attempting to move confidential Federal Open Market Committee files to unauthorized destinations. Those attempts included copying FOMC files to an unencrypted USB drive in 2021, emailing files to a personal address in 2023, and copying classified files to another unencrypted USB drive later in 2023. The employee, who retired in July 2024, claimed the 2021 action was a mistake and the 2023 email was “inadvertent.” The IG reported that available records did not provide a clear indication of what information the employee had removed, and many of the alerts tied to the case were false positives.

“

The Division of International Finance sits at the intersection of U.S.

That combination—a repeated pattern of flags, an employee who still exited normally, and an incomplete forensic picture—is precisely why the IG elevated the matter beyond a single personnel problem. The report states the specific details “help to illustrate the systemic concerns” about the Fed’s offboarding process for employees with access to confidential policymaking information. Those breakdowns, the IG said, require “the Board’s immediate attention so that it can take appropriate corrective actions.” The central bank’s Board of Governors did not immediately respond to a request for comment, and the IG declined to identify the employee.

The Division of International Finance sits at the intersection of U.S. monetary policy and global economic conditions. Its staff routinely handle FOMC briefing materials, economic projections, exchange-rate analysis, and policy scenarios before they become public. Unauthorized removal of those records is not merely a bureaucratic infraction; it is a potential market-integrity event. Pre-decisional macro information can carry a trading advantage, and the Fed has long operated under strict protocols to limit who sees what before scheduled releases. The IG’s finding that a departing employee attempted multiple exfiltration routes—removable media and personal email—without approval, despite prior guidance on offboarding information, raises questions about whether those protocols are enforced consistently at the point of greatest insider-threat risk: the moment an employee disengages.

From a cybersecurity perspective, the case reads like a classic insider-threat trajectory. Detection systems fired in 2021 and 2023, but the organization apparently lacked the investigative or disciplinary follow-through to establish what was taken. False positives complicated the picture, and the IG notes records were insufficient. That creates a particularly frustrating situation for security and compliance teams: alerts that may be too noisy to act on individually can still represent a pattern that only becomes visible in hindsight. Unencrypted USB drives remain a serious vector because they can be lost, copied, or re-read elsewhere without leaving the same audit trail as network transfers. The fact that an employee attempted personal-email exfiltration after previously being caught copying to USB indicates either a repeated misunderstanding of policy or a disregard for it, and the IG’s warning to the Board suggests the latter possibility was not ruled out.