Developments in areas of artificial intelligence (AI), quantum computing, and the expansion of the Internet have revolutionized the way we all live. Despite the positive aspects of these developments, there is an increasing trend of concerted assaults launched upon the unknowing and unwary.

Today, cyberattacks are causing considerable damage, the effects of which are being suffered through all levels of our society. Businesses, hospitals, schools, and even governmental entities—which frequently maintain outdated, unsophisticated computer systems—have all fallen victim to cyberattacks. It should not be surprising, then, that private-sector retirement accounts are increasingly under attack and qualified plan sponsors are facing many questions and concerns. Given that federal law imposes a fiduciary duty and responsibility for the security of plan assets, what must they do as cybercriminals place their hands into the figurative cookie jar?

In answering this question, it is important to first understand the contours of this duty. A fiduciary duty is the highest legal responsibility that arises between a fiduciary and a beneficiary, exposing the fiduciary to personal liability for any breach of that duty. The responsibility mandates that the fiduciary act strictly in the best interests of beneficiaries, underscored by the duties of loyalty, care, and good faith. A breach of fiduciary duty can result in, among other things, legal action by a beneficiary seeking compensatory and even punitive damages from the harm suffered on account of the breach. The possibility of recovering attorneys' fees is also apparent through this legal action. Some examples of fiduciary relationships include the trustee-beneficiary relationship and the plan sponsor–plan participant relationship.