CFPB isn't the first regulator to take actions against startups for not securing customer's personal data in a more protected fashion, but it is the first to action taken a fintech enterprise. This goes back to the discussion on the importance of compliance and security measures from day one of the startups' life, as this specific claim has to do with practices Dwolla carried out back in 2011 and 2012. Fintech's beware, you may need to call that IT guy to start digging into old data logs...