CFPB isn't the first regulator to take actions against startups for not securing customer's personal data in a more protected fashion, but it is the first to action taken a fintech enterprise. This goes back to the discussion on the importance of compliance and security measures from day one of the startups' life, as this specific claim has to do with practices Dwolla carried out back in 2011 and 2012. Fintech's beware, you may need to call that IT guy to start digging into old data logs...
“With data breaches becoming commonplace and more consumers using these online payment systems, the risk to consumers is growing,” CFPB Director Richard Cordray said in a statement. “It is crucial that companies put systems in place to protect this information and accurately inform consumers about their data security practices.”
http://www.wsj.com/articles/cfpb-fines-fintech-firm-dwolla-over-data-security-practices-1456956326