Playing · muted

Data · AI · Risk

AI can't outrun bad data.

Fortify your data foundation first.

Built for: Banks, Credit Unions, Fintech, Healthcare, Insurance, Private Equity, Vertical Market Software, and Wealth Management.

Industries

The regulator's name changes. The question doesn't.

Your vendor's subcontractors

Banks

Federal third-party guidance expects banks to check how their vendors select and oversee their own subcontractors. Do you know where that data sits?

 Vendor access to member data

Credit Unions

742 of 1,072 cyber incidents credit unions reported to NCUA in the rule's first year involved a third-party vendor. Where does your member data go?

 Data in every layer of the stack

Fintech

Products, cores, surrounds, white-labels. If unencrypted data on 500 or more consumers is acquired without authorization, the FTC Safeguards Rule gives you no more than 30 days from discovery to notify the FTC.

 The business associate clock NEW

Healthcare

Your billing vendor, your EHR, your scribe AI. HIPAA's 60-day clock starts the moment any one of them discovers a breach.

 Your vendor, your duty NEW

Insurance

28 jurisdictions have implemented the NAIC model law, which requires licensees to vet every vendor that touches their data and make them secure it. Can you name every one?

 The Reg S-P clocks

Private Equity

30 days to notify after unauthorized access. 72 hours for a vendor to tell you. This isn't a survey.

 Product data vs. company data

Vertical Market Software

The product has data. The company has data. Blackbaud agreed to pay $49.5 million to 49 states and DC over its 2020 security incident, without admitting fault.

 Three views · private wealth NEW

Wealth Management

Wealth Management, RIA, and Family Offices (single / multi), one tile, three optional views. Same data, AI, and vendor questions; different registration and opacity.

How we work

Master the Map. Own the Summit

Foundation First. Speed Second

Focus 01

Data Governance

Governance is the map that makes management, AI, and vendors answerable.

Policies, owners, approvals, and proof. A map you can show a board, examiner, or buyer. Not a binder on a shelf.

Policy · ownership · approvals · proof

Focus 02

Data Management

If you can't name where it lives, you can't protect it.

Catalogs, retention, access paths, and sprawl across cores, drives, and systems of record.

Inventory · location · ownership · retention

AI governance command center

Focus 03

AI Governance

Shadow AI moves data whether you approved it or not.

Find the tools. Name the data they touch. Leave a paper trail a board or examiner can follow.

Shadow AI · inventory · exam-ready trail

Focus 04

Vendor Risk Management

Your vendors already hold the data. Prove they're safe.

Third parties, white-labels, and AI APIs — including the vendor's vendor. Diligence you can act on, not questionnaire theater.

Third parties · vendor’s vendor · exam-ready diligence

The Path

From where data sits to where it belongs.

01

Listen.

A working session with your team. Same industry is not the same operating reality. We get clear on your data governance and data management practices.

02

Assess.

We inventory and follow the data: where it sits, how it moves, document real risks, then compile findings. Start small. Work iteratively.

03

Advise.

A ranked roadmap to close the risks and gaps we find, with clear Done-Done criteria for each. Your teams execute; we steer.

04

Verify.

Oversight on what’s open, pending, and closed. We also surface senior-leadership benefits as teams execute: speed, financial, risk mitigation tied to corporate goals.

About

Twenty years. One recurring question. Everyone still acts surprised.

Across mergers, spin-offs, joint ventures, divestitures, and regulatory exams, the same moment kept showing up: someone had to ask where the data lived and who owned it. That question is where the delays began.

Adam Papas spent two decades in operations and advisory across banking, fintech, private equity, and technology. COO and Chief of Staff for a large fintech core-banking division. VP of Strategy & Data Enablement at one of the Big Three credit bureaus. Operations leader at the second-largest U.S. lender through crisis-era consolidations.

APSTRAT exists to build that data foundation before the deal, the integration, the exam, or the plaintiff’s attorney forces the question.

Contact

Let’s talk about where the data sits.

A working conversation, not an intake maze. Tell us what you’re looking at, we’ll tell you what we’d look at first.

Message

Send a note

Not ready to book a call? Send a note and we’ll follow up.

0 / 300

Calendar

Schedule a working session

Ready to talk? Pick a time. You’ll get a calendar invite.

CITATIONS NEW

Every citation on this site, in one searchable table.

Filter by industry or type, or search for a regulator, a dollar figure, or a company name. Nothing here is summarized twice, this is the same evidence behind every page, just queryable.

← Industries

BANKS

NPI is a GLBA duty.
Federal guidance asks how your vendors oversee theirs.

Cataloging, paths, controls, and AI: the four questions we ask about nonpublic personal information. Is unapproved AI one of the paths?

← Industries

BANKS.SYS
Figures and Stats
Data provided from cited sources. Citations
BK-17
$1.7 billion
Without admitting or denying the findings, Wells Fargo Bank, N.A. was ordered by the CFPB to pay a $1.7 billion civil money penalty, in addition to more than $2 billion in consumer redress, for legal violations across its auto loan, mortgage and deposit account businesses.
Details
CFPB · 2022-12-20. Source
BK-16
$450 million
The OCC issued a cease and desist order and a $450 million civil money penalty against TD Bank, N.A. and TD Bank USA, N.A. for deficiencies in the bank's Bank Secrecy Act and anti-money laundering compliance program; the bank neither admitted nor denied the OCC's findings.
Details
OCC · 2024-10-09. Source
BK-14
$80 million
Capital One, N.A. and Capital One Bank (USA), N.A., which neither admitted nor denied the OCC's findings, were assessed an $80 million civil money penalty for failing to establish effective risk assessment processes before migrating significant information technology operations to the public cloud, conduct the OCC found did not comply with the interagency information security standards.
Details
OCC · 2020-08-05. Source
BK-15
$60 million
Morgan Stanley Bank, N.A. and Morgan Stanley Private Bank, N.A., which neither admitted nor denied the OCC's findings, were assessed a $60 million civil money penalty for failing to oversee the 2016 decommissioning of two Wealth Management data centers, including failing to keep an appropriate inventory of customer data stored on the decommissioned hardware.
Details
OCC · 2020-10-08. Source
BK-3
3,611
The FBI's Internet Crime Complaint Center received 3,611 ransomware complaints in 2025, compared with 3,156 in 2024 and 2,825 in 2023, across all industries.
Details
FBI Internet Crime Complaint Center · 2025. Source
BK-8
four business days
Public companies must generally file an Item 1.05 Form 8-K within four business days after determining that a cybersecurity incident is material.
Details
SEC · 2023-07-26. Source
CREDIT UNIONS

742 of 1,072 cyber incidents reported to NCUA in the rule's first year involved a vendor.
NCUA can't sit inside that vendor. You can.

Core, loan files, call recordings, emails, shared drives, five places member data lives, and one regulator with no authority to examine the vendors holding it.

← Industries

CREDIT_UNIONS.SYS
Figures and Stats
Data provided from cited sources. Citations
CU-E1
$100,000
Without admitting or denying the Commissioner's findings, Patelco Credit Union agreed to pay a $100,000 penalty under a February 2025 California DFPI consent order over its cybersecurity.
Details
California DFPI · 2025-02-04. Source
CU-10
742 of 1,072
Of 1,072 cyber incidents that credit unions reported to NCUA from September 1, 2023, when its cyber incident notification rule took effect, through August 31, 2024, 742 were related to the use or involvement of a third-party vendor.
Details
NCUA · 2024-10-24. Source
CU-8
588
Credit unions reported 588 cyber incidents to NCUA from May 1, 2025, through April 30, 2026, according to NCUA's June 2026 report to Congress.
Details
NCUA · 2026-06-17. Source
CU-11
234
The largest of 13 third-party events among the cyber incidents reported to NCUA from September 1, 2023, through August 31, 2024, affected 234 credit unions.
Details
NCUA · 2024-10-24. Source
CU-12
72 hours
A federally insured credit union must notify NCUA of a reportable cyber incident as soon as possible and no later than 72 hours after it reasonably believes it has experienced one.
Details
NCUA · 2023-09-01. Source
FINTECH

Data is in everything these companies do.
The leak is not inside the named core.

Products, cores, surrounds, and third-party white labels. Every layer holds a different slice of customer data, and every layer has its own vendor chain beneath it.

← Industries

FINTECH.SYS
Figures and Stats
Data provided from cited sources. Citations
FT-CFPB-1
$25,000,000
Without admitting or denying the findings, payment processor ACI Worldwide Corp. and ACI Payments, Inc. consented to a CFPB order imposing a $25,000,000 civil money penalty for unfair information-security practices involving sensitive consumer financial information.
Details
CFPB · 2023-06-27. Source
FT-LF-1
$25,000,000
loanDepot, a non-bank mortgage lender and servicer, agreed to a $25,000,000 class settlement fund over its January 2024 data breach while denying any wrongdoing, a class fund rather than a regulator fine.
Details
Courts · 2025-08-25. Source
FT-LF-2
$15,000,000
Block, Inc., a licensed money transmitter, and its broker-dealer subsidiary Cash App Investing LLC agreed to a $15,000,000 class settlement fund over Cash App data-security incidents without admitting any liability or wrongdoing, a class fund rather than a regulator fine.
Details
Courts · 2025-03-27. Source
FT-LF-3
$14,950,000
TaxAct agreed to a $14,950,000 class settlement fund, while denying any wrongdoing, over allegations that it made users' personal and financial information accessible to third parties including Meta and Google, a class fund rather than a regulator fine.
Details
Courts · 2024-12-30. Source
FT-LF-4
$11,858,259.98
Evolve Bank & Trust, an Arkansas state-chartered bank that partners with fintech companies, agreed to an $11,858,259.98 class settlement fund after its February and May 2024 data breach, a class fund rather than a regulator fine.
Details
Courts · 2025-12-15. Source
FT-DF-1
$2,000,000
PayPal, Inc., which holds NYDFS money transmitter and BitLicense licenses, agreed to pay a $2,000,000 NYDFS Part 500 civil monetary penalty tied to unredacted Social Security numbers and access-control failures.
Details
NYDFS · 2025-01-23. Source
HEALTHCARE NEW

192.7 million records.
One missing login step.

Change Healthcare's CEO confirmed under Senate testimony that the breach came down to one remote-access portal without multi-factor authentication, company policy required it, but it hadn't been enabled. EHR, scribe AI, billing, and claims clearinghouses all touch PHI the same way; cataloging your own exposure is the only version of this that's actually in your control.

← Industries

HEALTHCARE.SYS
Figures and Stats
Data provided from cited sources. Citations
HC-PIN1
$16 Million
Anthem paid OCR $16 million in what HHS called a record HIPAA settlement, following what was then the largest health data breach in history.
Details
HHS / OCR · 2018-10-15. Source
HC-5
$1,190,000
OCR's civil money penalty of $1,190,000 against Gulf Coast Pain Consultants, LLC d/b/a Clearway Pain Solutions Institute, a pain-management practice, is final.
Details
HHS / OCR · 2024-09-27. Source
HC-8
$548,265
OCR's civil money penalty of $548,265.00 against Children's Hospital Colorado, a HIPAA covered entity, for Privacy Rule and Security Rule violations is final.
Details
HHS / OCR · 2024-09-26. Source
HC-6
$175,000
OCR settled for $175,000 with BST & Co. CPAs, a New York accounting firm that is in scope only as a HIPAA business associate, in its 15th ransomware enforcement action.
Details
HHS / OCR · 2025-08-18. Source
HC-4
$75,000
Comstar, LLC, a HIPAA business associate that provides billing services to emergency ambulance services, paid OCR $75,000 and agreed to a two-year corrective action plan to settle an investigation of a ransomware breach that affected 585,621 individuals.
Details
HHS / OCR · 2025-05-30. Source
HC-PIN2 ★ LANDMARK
192.7 million
Change Healthcare notified OCR that approximately 192.7 million individuals have been impacted by its breach, in which criminals used compromised credentials to remotely access a Citrix portal that did not have multi-factor authentication.
Details
HHS / OCR (notified) · 2025-07-31. Source
INSURANCE NEW

28 jurisdictions have the same rule now.
Two insurers turned into eight.
And there's a second NAIC rule just for AI.

The NAIC model law reads almost clause-for-clause like the GLBA vendor-oversight duty your Banks page already covers. The 2024 quoting-tool breach wasn't a two-company story either, regulators eventually fined eight auto insurers for the same pattern. And a separate NAIC bulletin now requires insurers to govern their AI the same way they govern everything else.

← Industries

INSURANCE.SYS
Figures and Stats
Data provided from cited sources. Citations
IN-8
over $144 million
As of its October 14, 2025 announcement, NYDFS said that under Superintendent Adrienne A. Harris it had entered into consent orders with 27 entities for violations of its cybersecurity regulation, resulting in over $144 million in fines; the count covers all types of DFS-regulated entities, not insurers alone.
Details
NYDFS · 2025-10-14. Source
IN-5
More than $19 million
NYDFS secured more than $19 million in penalties from eight auto insurance companies for violations of its cybersecurity regulation.
Details
NYDFS · 2025-10-14. Source
IN-3
$11.3 million
The New York Attorney General and NYDFS secured $11.3 million in penalties from auto insurers GEICO and Travelers for poor data security that led to the compromise of personal information of more than 120,000 New Yorkers.
Details
NY AG + NYDFS · 2024-11-25. Source
IN-6
$6,000,000.00
Landmark Admin, LLC, a third-party administrator for insurance carriers, and six insurance companies named as co-defendants settled a class action over Landmark's 2024 data security incident, with Landmark's total payment subject to an overall cap of $6,000,000.00; the defendants deny all claims of wrongdoing.
Details
Courts · 2026-01-29. Source
IN-9
$4.5 million
EyeMed Vision Care LLC, licensed by NYDFS to sell life, accident and health insurance, agreed to pay a $4.5 million penalty for violations of the NYDFS cybersecurity regulation after a July 1, 2020 phishing attack reached a shared email mailbox whose login credentials nine employees shared and which held over six years of consumer non-public information.
Details
NYDFS · 2022-10-18. Source
IN-7
$3,250,000
Progressive Casualty Insurance Company agreed to a $3,250,000 non-reversionary class settlement fund over a security incident at TTEC, one of its third-party call-center vendors, without admitting liability.
Details
Courts · 2025-02-25. Source
PRIVATE EQUITY

Regulation S-P: 30 days to notify.
72 hours for a vendor to tell the adviser.
It is not a PE survey.

Shadow AI is becoming one of the defining diligence issues of the next several years, and the absence of a centralized AI record is, on its own, a material finding.

← Industries

PRIVATE_EQUITY.SYS
Figures and Stats
Data provided from cited sources. Citations
PE-E4
$20 million
Rachel Knepp, a former senior vice president of Mozaic Payment System, Inc., pleaded guilty on 2025-11-19 to wire fraud conspiracy in a scheme that DOJ describes as defrauding a Boston private equity firm of $20 million; the charges against former CEO Marcus Cobb are pending allegations.
Details
U.S. Department of Justice (D. Mass.) · 2025-12-12. Source
PE-11
$12,500,000
Without admitting or denying the findings, four Apollo private equity fund advisers agreed to pay a $12,500,000 civil penalty as part of an SEC settlement over undisclosed accelerated monitoring fees, misleading loan-interest disclosures and a failure to reasonably supervise a former senior partner who charged personal expenses to Apollo-advised funds and portfolio companies.
Details
SEC · 2016-08-23. Source
PE-10
$10,000,000
Without admitting or denying the findings, three Blackstone private equity fund advisers agreed to pay a $10,000,000 civil penalty, plus $28,911,756 in disgorgement and prejudgment interest for affected funds and limited partners, over inadequately disclosed accelerated monitoring fees and a legal fee discount arrangement.
Details
SEC · 2015-10-07. Source
PE-7
$4,500,000
Without admitting or denying the findings, Global Infrastructure Management, LLC, a registered investment adviser to private equity funds it managed, agreed to pay a $4,500,000 civil penalty for failing to properly offset management fees, making misleading statements to investors about fee offsets, and failing to adequately implement compliance policies and procedures.
Details
SEC · 2021-12-20. Source
PE-8
$1,000,000
Without admitting or denying the findings, Ares Management LLC, which the SEC described as a Los Angeles-based private equity firm and registered investment adviser, agreed to pay a $1,000,000 civil penalty for failing to implement and enforce policies and procedures reasonably designed to prevent the misuse of material nonpublic information.
Details
SEC · 2020-05-26. Source
PE-S1
30 days
An SEC-registered investment adviser, as a covered institution under Regulation S-P, must notify affected individuals as soon as practicable, but not later than 30 days, after becoming aware that unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred, unless the U.S. Attorney General determines that notice poses a substantial risk to national security or public safety.
Details
SEC · 2024-05-16. Source
VERTICAL MARKET SOFTWARE

The product has data.
The company has data.
Do you know where both sit?

Vertical software sits inside nonprofits, schools, healthcare, dealerships, and more, holding customer data in the product and in the vendor's own systems. Is AI inside the product too? Can you point to one map?

The settlements and filings that prove the pattern are in Sources below, not in the headline.

← Industries

VERTICAL_MARKET_SOFTWARE.SYS
Figures and Stats
Data provided from cited sources. Citations
VMS-E2
$49.5 million
Blackbaud, Inc., a software provider serving the nonprofit and education sectors, agreed to pay $49.5 million to 49 states and the District of Columbia to resolve a multistate investigation into its 2020 security incident, without admitting fault.
Details
49 state AGs + DC · 2023-10-05. Source
VMS-E1
$5.1 million
The New York, California and Connecticut attorneys general secured $5.1 million in penalties and costs from education-software company Illuminate Education, Inc. for failing to protect students' data.
Details
NY, CA and CT AGs · 2025-11-06. Source
VMS-E4
approximately $1.5 million
Tyler Technologies, a government-software vendor, estimated that a September 2020 ransomware incident affecting its internal IT and telephone systems reduced quarterly revenue by approximately $1.5 million, and said it had no evidence that the environments hosting client applications were affected.
Details
Tyler Technologies, Inc. · 2020-11-04. Source
VMS-5
29
Roper Technologies manages cybersecurity locally in each of its 29 business units, which generally operate independently with separate infrastructure and systems.
Details
Roper Technologies, Inc. · 2026-02-24. Source
WEALTH MGMT NEW

Private wealth is not one registration story.

One tile. Three optional views. Wealth Management, RIA, and Family Offices (single / multi). Same data, AI, and vendor questions. Different clocks, opacity, and who the exam theater reaches.

Traditional wealth platforms and broker-dealer / advisory stacks. Data sprawl across CRM, custody, planning tools, and third-party processors, often with Reg S-P coverage when the firm is a covered institution.

Lead: inventory the map, then AI governance and vendor-held data, not a generic control deck.

← Industries

TRACE_THE_DATA.SYS · WEALTH_MGMT
Figures and Stats
Data provided from cited sources. Citations
WM-E3
$45 million
Broker-dealers Robinhood Securities LLC and Robinhood Financial LLC agreed to pay $45 million in combined SEC civil penalties to settle charges under more than 10 securities law provisions, including Regulation S-P and S-ID, admitting certain findings and neither admitting nor denying the others.
Details
SEC · 2025-01-13. Source
WM-1
30 days
Under amended Regulation S-P, a covered institution, including an SEC-registered investment adviser, must notify affected individuals as soon as practicable, but not later than 30 days, after becoming aware that unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred.
Details
SEC · 2024-05. Source
WM-E4a
$1,250,000
Neither admitting nor denying the findings, Fidelity Brokerage Services LLC agreed to pay a $1,250,000 administrative fine under a Massachusetts Securities Division consent order finding that it failed to enforce certain cybersecurity controls, letting an unauthorized third party obtain document images with personal information of approximately 77,000 customers and individuals in August 2024, and failed to notify some Massachusetts residents.
Details
Massachusetts Secretary of the Commonwealth · 2026-04. Source
WM-10
$1,000,000
Without admitting or denying the findings, Voya Financial Advisors, Inc., a dually registered broker-dealer and investment adviser, agreed to pay a $1,000,000 SEC civil penalty for Regulation S-P Safeguards Rule and Regulation S-ID Identity Theft Red Flags Rule violations after intruders posing as its contractors gained access to PII of at least 5,600 customers.
Details
SEC · 2018-09-26. Source
WM-E2
$400,000
Without admitting or denying the SEC's findings, investment advisers Delphia (USA) Inc. and Global Predictions Inc. agreed to pay $400,000 in total civil penalties for false and misleading statements about their purported use of artificial intelligence.
Details
SEC · 2024-03-18. Source
WM-E1
$325,000
Without admitting or denying the findings, M Holdings Securities, Inc., a dual-registered broker-dealer and investment adviser, agreed to pay a $325,000 SEC civil penalty for Regulation S-P and S-ID failures after email account takeovers at 13 of its 120 member firms, from which phishing emails were sent to approximately 8,500 individuals.
Details
SEC · 2025-11-25. Source