Supervisory correspondence: a bank’s most candid file, held in a system it cannot assess

The week

Every bank keeps one file it would least like a stranger to read: the frank, detailed correspondence with its regulator about what is wrong and how it plans to fix it. In April 2025, banks learned that some of that correspondence may have been read by an intruder, and not on their own systems.

On April 8, 2025, the Office of the Comptroller of the Currency notified Congress that a compromise of its email system was a major information security incident. The OCC is the federal agency that charters and supervises national banks. Its examiners spend their working lives inside those banks, reviewing their finances, risk controls and technology. “Major incident” is a formal designation under federal rules for the most serious security events at government agencies, and it triggers a report to Congress.

The timeline stretched back weeks. The OCC had found unusual activity involving an administrative account in its email environment on February 11. An administrative account is one with special powers over a system. The agency disclosed the intrusion publicly on February 26.

That first disclosure was brief and reassuring. The OCC said it had identified, isolated and resolved a security incident involving an administrative account in its email system. It said it had reviewed email logs going back to 2022, found a limited number of affected accounts, disabled them, and reported the incident to the Cybersecurity and Infrastructure Security Agency. It added that there was no indication of any impact on the financial sector at that time.

The disclosure landed in an uneasy season for financial agencies. The OCC is a bureau of the Treasury Department. In late December 2024, Treasury had told Congress that a China-linked actor had reached departmental workstations and unclassified documents through a vendor’s compromised remote support service. Two incidents disclosed about two months apart at the same department made the question of how agencies protect supervisory data harder to dismiss.

By April, the picture was more serious. The OCC said intruders had read the email of a number of executives and employees, and that the messages included highly sensitive information on the financial condition of federally regulated banks. Press reports, led by Bloomberg, put the number of accounts at about 100 and said access dated to mid-2023 and covered more than 150,000 emails. If those reports were right, someone had been reading regulators’ mail unnoticed for well over a year and a half.

The OCC’s April 8 release set out the process behind the designation. The agency said it had confirmed the activity was unauthorized on February 12, the day after detection, and activated its incident response procedures. Those included an independent third-party forensic assessment. Its review of the accessed emails and attachments, carried out by internal data science staff and outside firms, had found the sensitive bank information. On April 7, in consultation with the Treasury Department, the OCC concluded the incident was major under the Federal Information Security Modernization Act. OMB guidance gives agencies seven days from that determination to notify Congress. The OCC did so the next day.

The release also signaled institutional consequences. The OCC said it was evaluating its IT security policies and procedures, and was bringing in another independent party to assess its internal processes for handling cyber incidents. Acting Comptroller Rodney Hood promised full accountability for the weaknesses identified. He also said he was working to address long-standing organizational and structural deficiencies that had contributed to the breach. Regulators rarely describe their own shortcomings in those terms.

The OCC said outside experts were reviewing the incident. The banking industry reacted quickly. Within a week, Bloomberg reported that JPMorgan Chase and BNY had limited the information they shared with the OCC electronically. That is a striking step: two of the country’s largest banks choosing to send less to their own primary supervisor through electronic channels.

For banks, the timing was awkward in another way. Since 2022, federal rules have required banks to notify their primary federal regulator within 36 hours of a significant computer-security incident. Much of that reporting, along with examination responses, moves through the same agency systems. The OCC is the primary federal regulator for national banks and federal savings associations, so its mailboxes held incident details as well as examination material.

The week raised an uncomfortable question for banks. Banks spend a great deal of effort checking the security of the vendors they share data with. What should they do when the party holding their most sensitive information is one they cannot check at all?

Banks assess their vendors in detail. They cannot assess their regulators. Supervision requires a bank to hand over its most candid material: examination responses, remediation plans, incident details and descriptions of control gaps not yet closed. The bank does not choose the system that receives it.

The OCC breach did not change the duty to share. It did show that this material lives in a concentrated store of sensitive data on many banks, protected by controls the banks cannot see. Bloomberg reported that bank submissions can include cybersecurity assessments and vulnerability reports, which is what makes the exposure strategic. A list of a bank’s known weaknesses is, from an attacker’s point of view, a map.

A bank has three levers over this risk: the content of what it sends, the channel it uses, and its contingency plan for when the holder is breached.

How much a regulator knows about a bank

Examinations. Bank regulators send examiners into the institutions they supervise, sometimes continuously for the largest banks. Examiners look at loans, capital, liquidity, governance and, increasingly, technology and cybersecurity. They ask for documents, interview staff and test controls.

Findings and remediation. When examiners find a weakness, they issue a formal finding. In OCC practice, a serious one is called a “matter requiring attention.” The bank must respond with a plan to fix it and report progress until the issue is closed. Those responses are, by design, honest and specific. A vague remediation plan does not satisfy an examiner.

Supervisory information. The resulting body of material, including examination reports, findings, the bank’s responses and related correspondence, is treated as confidential. Under OCC rules, non-public supervisory information is the agency’s property, which limits what a bank may disclose about it without permission.

Email and portals. Regulators generally offer secure portals, websites where banks can upload documents through an encrypted, access-controlled connection. But much day-to-day exchange still happens by email, the same way most business does.

Put together, a regulator holds a detailed, current account of the weaknesses of every bank it supervises. For an attacker interested in banks, that is a far richer target than any single bank.

The OCC’s account of its own breach involved its email environment. In its April 14 letter to banks, discussed in the hindsight section below, the agency said the intruder had used a service account with administrative privileges. A service account is an account used by software rather than a person, often to keep systems running in the background. Because no human logs in with it day to day, misuse can go unnoticed for a long time.

Who holds what, by charter

The exposure is spread across agencies, and which agency holds a bank’s file depends on its charter. National banks and federal savings associations are supervised by the OCC. State-chartered banks that are members of the Federal Reserve System are supervised by the Federal Reserve and their state banking department. State banks that are not members are supervised by the FDIC and their state. Bank holding companies answer to the Federal Reserve. Federally insured credit unions are supervised by the NCUA, and state-chartered credit unions by their state as well.

Each of those agencies receives a similar flow of material. Examination responses and remediation updates go to the primary supervisor. Notices of significant computer-security incidents go to the primary federal regulator within 36 hours under the 2021 interagency rule. Federally insured credit unions report certain cyber incidents to the NCUA within 72 hours under a rule that took effect in 2023. A state-chartered bank in New York may also owe a 72-hour notice to the Department of Financial Services under its cybersecurity regulation. A mid-sized bank can therefore have candid material in three or four agency systems at once.

Regulators also hold information about banks’ vendors. Under the Bank Service Company Act, federal banking agencies can examine companies that provide certain services to banks, including core processors and other technology providers. Their reports on those providers describe weaknesses that affect many client banks at once. A breach of that material would expose a bank through a door it never opened.

Assurance a bank can and cannot get

The 2023 interagency guidance on third-party relationships describes a life cycle: planning, due diligence, contract negotiation, ongoing monitoring and termination. Almost none of it applies to a regulator. A bank cannot perform due diligence on its supervisor, negotiate terms, request a SOC 2 report, or end the relationship. The usual tools of third-party risk management assume a choice the bank does not have.

Some assurance exists, though it is indirect. Federal agencies are subject to the Federal Information Security Modernization Act, annual evaluations by their inspectors general, audits by the Government Accountability Office, and binding directives from CISA. Many of those reports are public. A bank’s security team can read the inspector general’s annual FISMA evaluation for its supervisor’s department and form a general view of maturity. It cannot use that view to change anything. The levers below work because they depend only on decisions the bank makes.

Content: what goes into the correspondence

Examiners need detail, and banks should not withhold it. But much exploitable specificity in supervisory correspondence is incidental. A remediation update can describe a segmentation gap without naming the subnet, the firewall model and the unpatched version. (Segmentation is the practice of dividing a network into compartments so a break-in in one cannot spread easily. A subnet is one of those compartments, and a firewall is the gatekeeper between them.) An incident report can explain root cause without listing the service accounts that were abused. The examiner can request more through a secure channel or review it on site.

Telling your doctor that you have a weak knee is necessary. Posting your house’s alarm code and the time you leave for physical therapy in the same letter is not. The second kind of detail rarely helps the reader and very much helps someone who should not be reading.

This is a drafting discipline, and it belongs with the people who write the material. Compliance, internal audit and information security staff who prepare responses to matters requiring attention should apply a simple test. Would this sentence help an attacker more than it helps the examiner? If so, describe the control gap and offer the specifics on request. A short internal standard, reviewed by counsel, keeps the practice consistent and defensible if an examiner asks why detail was summarized.

The trade-off is friction. Examiners may ask follow-up questions that a fuller first response would have avoided. Some will prefer documents to on-site review. Banks should raise the practice with their examination teams early, framed as shared security, so it does not look like evasion. A regulator has every reason to want its own files to be less attractive to intruders.

Retention is part of content discipline too. Supervisory correspondence tends to accumulate in shared mailboxes at both ends. Banks can set their own retention for working copies and ask, through their examination teams, how long the agency keeps routine correspondence. Less material held for less time means less to lose.

Three tiers of correspondence

A drafting standard works best when it sorts correspondence into tiers. The first tier is logistics: meeting times, document request lists, names of contacts. It can travel by ordinary email with little risk. The second is narrative: descriptions of findings, root causes, remediation plans and timelines. It belongs in the secure portal and should describe weaknesses at the level of control, system and business process. The third is technical specifics: hostnames, IP addresses, account names, software versions, configuration settings, network diagrams and raw scanner or penetration test output. It should be shared only on request, through the most controlled channel available, or reviewed on site.

Most exposure comes from attachments rather than prose. Banks often answer a request list by exporting whole reports: a full penetration test with its exploitation steps, a vulnerability scan listing every unpatched host, a network diagram with addresses. An examiner usually needs the summary, the risk rating, the remediation status and the evidence that fixes were validated. The bank can offer the full report for on-site review or through a viewing session without handing over a copy.

How the discipline differs by institution

The largest banks have examiners on site throughout the year and dedicated regulatory relations teams. For them, the standard is a matter of training a few dozen people who write to examiners and enforcing it through a review step. Community banks face a different pattern. Examinations are periodic, and much of the material goes out in a large batch before the exam starts, often assembled quickly by a small compliance team. The standard for a community bank should focus on that batch: which reports go in full, which go as summaries, and who signs off before upload.

Credit unions and state-chartered institutions should apply the same tiers to each agency they report to. A state-chartered bank examined alternately by its state and a federal agency has two sets of examiners and two sets of systems. The drafting standard should not change with the recipient. The channel may.

Candor is not negotiable

The strongest objection to content discipline is that it could look like concealment. Examiners judge management partly on transparency, and a bank that appears to filter information may face a harder examination or a finding about governance. That risk is real, and it sets the boundary. The bank must never omit the existence, severity or status of a weakness. The standard governs only the operational detail that would help someone exploit it, and that detail must be available promptly on request. Written that way, the standard changes how candid information is packaged, not how candid it is.

Banks should also mark submissions as confidential. Examination-related records generally fall under exemption 8 of the Freedom of Information Act, and agency rules restrict disclosure of supervisory information. Marking does not protect a mailbox from an intruder, but it helps ensure the material is handled under the right rules once it arrives.

Channel: how the material travels

Most regulators offer secure portals for document submission. In practice, a great deal still moves by email: attachments to examiners, replies with spreadsheets, scheduling threads that grow into substantive discussion. Email copies material into many mailboxes, and each mailbox is a separate exposure. One attachment sent to five examiners and copied to a manager now lives in six places, plus backups.

Banks can route substantive material through the regulator’s secure portal by default and keep email for logistics, such as meeting times and document requests. Where email is unavoidable, they can send encrypted files with keys exchanged separately. Or they can send a pointer to a document held in a bank-controlled data room with access logging. A data room is a secure online space where documents can be viewed by invited people, with a record kept of every visit.

That last option has a useful property. The bank can see who accessed the material and can revoke access if the regulator reports a compromise. Instead of hoping that copies in someone else’s mailbox are safe, the bank holds the original and decides who may look at it.

The channel question extends beyond the primary regulator. Banks share supervisory and incident information with the Federal Reserve, the FDIC, state banking departments and FinCEN, the Treasury bureau that collects anti-money-laundering reports. Credit unions deal with the NCUA and state supervisors. Each agency runs its own systems. A bank’s channel standard should name the approved method for each.

Some large banks went further after the disclosure and limited electronic sharing with the OCC altogether for a period. That is a defensible short-term response for an institution with the staff to support on-site review. It is not a sustainable model for a community bank, and it shifts work onto examiners. The more durable answer is a channel the bank can monitor and revoke.

Why encryption in transit was not enough

Most email between banks and agencies is encrypted while it travels, through transport-layer encryption between mail servers. That protects messages from interception on the network. It does nothing once a message rests in a mailbox, where anyone with access to the mailbox can read it. The OCC intrusion reached mailboxes through an account with administrative privileges, which is exactly the threat transport encryption does not address.

Two techniques change that. Encrypting the attachment itself, with a password or key delivered through a separate channel, means the file in the mailbox is unreadable without the key. That protection holds only if the key never travels in the same mailbox, which is easy to get wrong. Sending a link to a bank-controlled repository means the mailbox holds a pointer, not the document. An intruder who reads the email still needs credentials to open the link, and the bank’s logs record any attempt.

Part of the channel standard can be enforced technically. A data loss prevention rule in the bank’s mail system can flag attachments of certain types sent to regulator domains and prompt the sender to use the portal instead. The rule should warn rather than block at first, because examiners sometimes need a file quickly. The exceptions it records show where the standard is not working and which teams need help.

What the agencies’ own channels offer

The federal banking agencies run secure systems for exchanging information with the institutions they supervise. The OCC’s BankNet and the FDIC’s FDICconnect are examples. Their strength is that documents are uploaded into an access-controlled environment rather than copied into many mailboxes. Their limit is that the bank still cannot see who opens a document after upload, or how long it is kept. They are a large improvement on email, but they still require trust in the agency’s controls.

Practical limits of a bank-controlled data room

Data rooms carry their own frictions. Agency networks may block external file-sharing services, and examiners may be barred by their own policies from using a bank’s platform. Those questions should be settled with the examination team before the bank relies on the approach. Banks should configure the room deliberately: view-only access where possible, watermarking, link expiry, named accounts with multifactor authentication, and a log reviewed after each examination cycle. A data room that permits unrestricted downloads simply recreates the mailbox problem one step later.

The data room also creates a new asset to protect. It holds the bank’s most sensitive self-assessments in one place, so its access controls and monitoring deserve the same scrutiny as any other high-value system. The trade is worthwhile because the bank can see and control that system.

Contingency: responding when the holder is breached

Incident response playbooks cover vendor breaches. Few cover a regulator telling a bank that supervisory correspondence may have been read by an intruder. That scenario has unusual features. The bank cannot investigate the regulator’s systems. It cannot demand a forensic report the way it might from a vendor. And because non-public supervisory information is the agency’s property, the bank is limited in what it may disclose about it without permission. Counsel needs to be involved from the start.

The essential tool is a register of what sensitive material went to which agency, when and by what channel. With a register, a bank can quickly identify which disclosed weaknesses might now be known to an attacker. It can then decide what to accelerate, such as closing a specific control gap, rotating credentials (changing passwords and keys) described in a report, or raising monitoring on systems named in correspondence. Without a register, the bank is reconstructing two years of email under time pressure.

Suppose a community bank told its examiners last year, in a remediation update, that an older payments server was due to be replaced in the third quarter. In the meantime, it said, it relied on a compensating control. If the bank keeps a register, it can see within an hour that this update went by email, on what date and to whom. Its security chief can then decide to bring forward the server replacement and watch that system more closely. Without one, the bank might not remember the update existed.

The playbook should name an owner, typically the chief information security officer working with the head of regulatory relations, and set criteria for escalation to the board.

It should also cover communication. Staff who deal with examiners will have questions, and so may customers or investors if the breach is in the news. Because the bank’s freedom to discuss supervisory information is limited, the playbook should include short, counsel-approved language explaining what the bank is doing to protect itself, without revealing the contents of any confidential correspondence. Writing that language in advance is far easier than drafting it during a busy week.

The first three days after notice

When a regulator reports that correspondence may have been read, the first day should establish scope. The bank asks its examination team which mailboxes, dates and message types were affected, recognizing that the agency may share only part of what it knows. The register then identifies what the bank sent in that window and through which channel.

The second day is triage. Each item is sorted by two questions: does it describe a weakness that is still open, and does it contain detail an attacker could use directly? An open weakness described with specifics goes to the top. A closed finding described in general terms goes to the bottom. Credentials, keys or account names mentioned in correspondence are rotated or changed regardless.

The third day turns to monitoring and governance. Detection rules are raised on the systems named in high-priority items. Threat intelligence feeds and information-sharing groups are watched for indicators tied to the intrusion. The board or its risk committee receives a short briefing on exposure, actions and remaining uncertainty.

Obligations that need counsel

Several legal questions arise, and each depends on facts. A regulator’s breach is not usually the bank’s own computer-security incident, so the 36-hour notification rule may not apply, but counsel should confirm. A publicly traded bank holding company must consider whether anything requires disclosure under the SEC’s cybersecurity rules or general materiality principles, and the restrictions on confidential supervisory information complicate that analysis. If correspondence included customer information, privacy obligations under the Gramm-Leach-Bliley Act and state breach laws may need review. Suspicious activity report material carries its own confidentiality rules and needs separate handling. Few of these questions can be answered well in the first week without preparation.

What the agency keeps, and for how long

Banks often assume that once an examination closes, the correspondence behind it fades away. Federal agencies keep records under the Federal Records Act and approved retention schedules, and examination files can be retained for years. A bank cannot ask an agency to delete what it sent, and it should not try. It can ask its examination team which channels the agency treats as the official record and how routine email is handled. The answer tells the bank where its history is likely to persist, and it shapes how far back a register needs to reach.

That answer also affects the contingency plan. If routine correspondence is retained for long periods, an intrusion like the OCC’s can expose material from several examination cycles. Findings closed years ago matter less, but descriptions of architecture and core systems change slowly. A network design described three years ago may still be accurate today.

One quarter, three levers

To see how the three levers fit together, follow the same hypothetical bank through an ordinary quarter after its leadership decides to act.

Week one: agreeing the approach. The chief information security officer, the head of compliance and the general counsel meet with the bank’s examiner-in-charge. They explain that, for shared security, the bank will describe control gaps in general terms in written updates and offer specifics on site or through the secure portal. The examiner agrees, and asks that specifics be available promptly when requested. Both sides note the arrangement in writing.

Weeks two to four: writing the standard. Compliance drafts a two-page drafting standard with before-and-after examples. In one example, “the unpatched version of the firewall protecting the payments subnet will be upgraded next quarter” is rewritten. It becomes “a network control protecting a payments system is scheduled for upgrade next quarter; details available on request.” Counsel reviews the standard so the bank can explain it if asked.

Weeks four to eight: setting the channels. The operations team lists every agency the bank reports to and the approved channel for each. Substantive documents go through regulator portals by default. For material that must be discussed over email, the team sets up a data room with access logs and sends links rather than attachments. Staff are reminded that scheduling threads are for scheduling.

Weeks eight to twelve: building the register and the playbook. A simple register records each sensitive submission: what it described, which agency received it, the date and the channel. The incident response plan gains a new scenario for a regulator breach, naming the security chief and the head of regulatory relations as joint owners. Counsel is engaged from the first hour, and the plan sets clear criteria for informing the board.

The quarter required no new technology spending of any size. It took a few meetings, a short document, a spreadsheet and a decision by leadership that the bank’s most candid file deserved the same care it gives to data shared with any vendor. At the end of the quarter, the board receives a one-page summary and a commitment to review the register and the playbook each year.

The same quarter looks different at a large bank. Its regulatory relations office may already route most material through portals, and its security team may already monitor data-sharing channels. The gaps tend to be in volume and dispersion: dozens of authors, several agencies and thousands of messages a year. The register becomes a system rather than a spreadsheet, fed by the tools that already track examination requests. For a credit union with a single compliance officer, the steps are the same at smaller scale, and the most useful single action is usually to stop attaching full technical reports to email.

A risk that surfaces months later

Boards should understand how this risk shows up, because it does not look like most cyber risks. It rarely produces fraud losses. If it materializes, it appears as a better-targeted attack months later, aimed at a weakness the bank had already admitted in writing. By then, few people will connect the attack to an email sent to a regulator long before.

There are several dimensions for directors to weigh.

• Security. An attacker who knows a bank’s open findings knows where to push. That shortens the time between intrusion and damage.
• Regulatory relationship. Changing how the bank shares information with its supervisor must be handled carefully, openly and in agreement with the examination team, or it risks looking like reluctance to cooperate.
• Legal constraints. Because supervisory information belongs to the agency, the bank’s ability to discuss an exposure publicly, or even with some partners, is limited. Counsel shapes every step.
• Reputation. Customers and investors are unlikely to distinguish between a breach at the bank and a breach of information about the bank. Preparation shapes how the bank answers questions.

Taken together, the three levers apply ordinary third-party discipline to an extraordinary third party, one the bank cannot assess or replace.

What the board should see

Directors cannot review correspondence, and they should not try. They can ask for a small set of evidence once a year. It includes the drafting standard and the date examiners were told about it, and the channel list by agency. It also includes a summary of the register and the date the regulator-breach scenario was last exercised. Large national banks already operate under the OCC’s heightened standards for risk governance, which expect boards to oversee a risk management framework covering all material risks. Exposure through supervisory correspondence fits inside that framework without a separate program.

For smaller banks and credit unions, the same evidence can be folded into the annual third-party risk report the board already receives. Listing regulators as a distinct category, with a note that they cannot be assessed and the controls that compensate, gives directors an accurate picture without much extra work.

The case for doing less

Reasonable people argue that this risk deserves little special effort. Several arguments carry weight.

First, regulators are not the only third parties holding a bank’s weaknesses. Auditors, consultants, penetration testers and law firms hold similar material, and some of them may be easier to breach than a federal agency. Second, an attacker who wants to find a bank’s weaknesses can often scan its internet-facing systems directly. Third, any change in how a bank shares with its supervisor carries relationship risk. Fourth, the intruders may have been interested in policy, enforcement plans or the agency itself rather than individual banks.

Each point has merit, and none defeats the argument. The other holders of sensitive material are third parties the bank can assess, contract with and replace, and its program already covers them. External scanning shows exposed systems, not internal weaknesses, compensating controls or remediation timetables. Relationship risk is managed by agreeing the approach with examiners in advance. The attacker’s motive cannot be known, and the bank has to plan for the use most harmful to it. The measures described here are inexpensive enough that a modest probability of harm justifies them.

The counter-arguments do set a limit. A bank should not spend more on this risk than on its own core controls, and it should not let the exercise delay remediation work. The best defense against a leaked list of weaknesses is a shorter list.

What a prepared bank has in place

A bank that has taken the OCC breach seriously tends to have these in place.

• A short drafting standard for supervisory correspondence, agreed with counsel and discussed with examiners.
• A default channel for each agency it reports to, with email kept for logistics.
• Where possible, a bank-controlled data room with access logs for substantive material.
• A register of sensitive material sent to each agency, with dates and channels.
• A regulator-breach scenario in the incident response plan, with named owners and board escalation criteria.
• Simple measures to show the practice is working. Examples are the share of substantive submissions sent through portals or the data room, and how quickly the register can say what went to a given agency in a given period.
• Data room settings reviewed after each examination cycle, with access removed for examiners who have moved on.

The errors are predictable.

• Assuming a regulator’s systems are safe because it is a regulator. The OCC’s experience shows otherwise.
• Over-correcting. Withholding detail examiners genuinely need, or cutting off electronic sharing without a plan, damages the supervisory relationship and may not be sustainable.
• Letting email sprawl. Scheduling threads that turn into substantive exchanges are the most common way sensitive detail ends up in many mailboxes.
• Keeping no register. Without one, a bank cannot assess its exposure quickly when a regulator reports a breach.
• Treating it as a security-only problem. Regulatory relations, compliance and counsel each own part of the response.

Where the bank’s candid file now sits

1. What are the most sensitive things we have told our regulators in the past two years, and could we list them by agency, date and channel today?
2. How much of that material went by ordinary email rather than a secure portal or a data room we control?
3. Do we have a drafting standard that keeps exploitable specifics out of correspondence, and have we discussed it with our examiners?
4. If our regulator told us tomorrow that its email had been read by an intruder, who would lead our response, and what would they do in the first day?
5. Has counsel told us what we may and may not say about supervisory information in a breach scenario?

With hindsight

The pause in electronic sharing by some large banks, reported in April 2025, showed that institutions would act on this risk even at the cost of friction with their primary supervisor. It was an unusual signal. Banks generally go to great lengths to keep their relationship with their regulator smooth, so choosing to send less electronically said a good deal about how seriously they took the exposure.

On April 14, the OCC wrote to the chief executives of the banks it supervises. An intruder had used a service account with administrative privileges in its Microsoft-hosted email environment to read mailboxes. The agency’s email ran on Microsoft’s cloud service, and a powerful background account had been turned against it.

The letter filled in the detection story. On February 11, Microsoft’s own threat-hunting team had alerted the OCC to unusual interactions between that service account and user mailboxes. Sign-ins to the account had been traced to a commercial virtual private network service, a common way for intruders to hide their location. The detection came from the cloud provider, not from the agency’s own monitoring.

The OCC said it had engaged Mandiant for an independent forensic assessment and later CrowdStrike for a similar investigation. It had reset all credentials across its Microsoft tenant (its portion of that cloud service). It said it had confirmed which mailboxes were compromised, the dates of compromise and the messages accessed, while analysis of the contents continued. It was hardening the environment in line with CISA’s Binding Operational Directive 25-01, issued in December 2024. That directive required federal civilian agencies to apply CISA’s secure configuration baselines to their Microsoft 365 environments.

The sequence carries a point for banks. A long-lived service account with broad mailbox access, signed into from an anonymizing network, went unnoticed by the agency for what press reports suggested was a long period. Service account inventory, least privilege for mailbox access and alerting on unusual sign-in locations are controls examiners expect banks to have. Banks can apply the same scrutiny to their own tenants, since the same failure can happen in any organization that runs on a similar platform.

One assumption did not survive the spring. Between February 26 and April 8, the OCC’s own description moved from a limited number of accounts with no indication of sector impact to a major incident involving highly sensitive information about regulated banks. A bank that waited for the regulator’s final account before acting would have lost weeks. The first notice of a regulator breach is a reason to start the playbook, not to wait for clarity.

Later in 2025, the OCC’s agenda moved toward narrowing examination findings. Working with the FDIC, it proposed to tie matters requiring attention more closely to material financial risk. If that approach holds, banks may produce fewer formal remediation responses on minor issues. The responses that remain will concentrate on the most significant weaknesses, which makes each one more sensitive, not less.

We have not found a public account of the review’s detailed findings, so banks should not assume the underlying weaknesses are resolved. Federal systems that hold sensitive data about private institutions remain attractive targets. The low-cost controls in this article remain worth applying to every agency a bank reports to.

The duty to be candid with regulators and the duty to protect sensitive information do not conflict, but they do need to be managed together. A bank cannot choose its regulator’s email system. It can choose what it writes, how it sends it and how ready it is to respond. Those choices cost little, and they are entirely within a bank’s own control.

Banks that made them in 2025 will be better placed the next time any agency they report to discloses an intrusion.