what should be done now to protect participant and beneficiary infor- mation entrusted to service providers against future attacks and unauthorized disclosure? While the extent of a fiduciary’s respon- sibility to protect personal identifiable information of participants and beneficiaries is unclear,