1

EAST\186404559.1

UNITED STATES DISTRICT COURT

NORTHERN DISTRICT OF ILLINOIS

EASTERN DISTRICT

MARTIN J. WALSH, 

Secretary of Labor, United States 

Department of Labor

Petitioner,

vs.

ALIGHT SOLUTIONS LLC,

Respondent.

:

:

:

:

:

:

:

:

:

:

:

:

:

CASE NO.: 1:20-cv-2138

DECLARATION OF ILENE GRANT IN SUPPORT OF MEMORANDUM IN SUPPORT 

OF RESPONDENT’S MOTION FOR PROTECTIVE ORDER

I, Ilene Grant, hereby declare under penalty of perjury:

1. I am a Vice President and Associate General Counsel at Alight Solutions LLC 

(“Alight”). 

2. I submit this declaration (the “Declaration”) in support of Alight’s Motion for 

Protective Order.

3. Except as otherwise indicated, all facts set forth in this Declaration are based upon 

my personal knowledge, my discussions with relevant employees of Alight, and my review of 

relevant documents. If called as a witness, I could and would testify competently to the facts set 

forth in this Declaration. 

4. I have reviewed the Department of Labor’s (the “DOL’s”) Subpoena and this 

Court’s October 28, 2021 order. In response, Alight is currently in the process of identifying, 

pulling, and producing additional documents responsive to the DOL’s requests. However, in 

reviewing the scope of the DOL’s requests and the representations made by the DOL, Alight 

DocuSign Envelope ID: 57B3FC90-C60C-45A7-B25D-CE9A3882BEB1 Case: 1:20-cv-02138 Document #: 31 Filed: 11/17/21 Page 1 of 10 PageID #:405
2

remains very concerned about the broad scope of the Subpoena, specifically the DOL’s broad 

requests for confidential and highly sensitive client and plan participant information. 

5. Specifically, Alight seeks judicial protection for three clearly defined categories of 

documents: (1) documents containing personal identifiable information (“PII”); (2) confidential 

settlement agreements involving Alight and its clients/others; and (3) client identifying 

information.

6. Alight is a global cloud-based provider of integrated digital human capital and 

business solutions, including healthcare and retirement benefits recordkeeping services with 

headquarters in Lincolnshire, Illinois. Since our formation in May 2017, Alight has served as one 

of the leading providers of benefits administration, cloud-based human resources and related 

financial solutions in the industry. Alight’s Employer Solutions include 

integrated benefits administration, healthcare navigation, financial health, employee wellness and

payroll designed to support employers in effectively managing their workforce. Across all 

solutions, Alight has several thousands of clients across the United States serving tens of millions 

of plan participants. 

7. One of the services that Alight provides is recordkeeping services for employee 

benefit plans, including plans subject to the Employee Retirement Income Security Act (“ERISA”) 

(“ERISA Plans”) and plans that are not subject to ERISA. These services may include: providing 

the architecture platform for the plan and its investment options, assisting with plan reporting 

including client benchmark and stewardship reports, providing administrative services and support 

to plan sponsors and plan participants, providing access to investment research, and providing 

compliance, regulatory, and legislative updates to plan sponsors. Alight currently provides 

recordkeeping services to retirement or welfare benefit plans (including defined benefit plans, 

DocuSign Envelope ID: 57B3FC90-C60C-45A7-B25D-CE9A3882BEB1 Case: 1:20-cv-02138 Document #: 31 Filed: 11/17/21 Page 2 of 10 PageID #:406
3

defined contribution plans, and health plans) to several hundred clients and over twenty million 

plan participants.1 

8. As a leader in cloud-based and remote outsourcing, the security and confidentiality 

of client data is of paramount importance to Alight. Our clients entrust Alight with highly 

sensitive information about their company and employee benefit plans including: total plan asset 

values, company contributions, the structure of company benefit plans, benefit plan designs, plan 

costs, and other market sensitive and proprietary information that would be detrimental if 

disclosed. For example, some of Alight’s clients base employer plan contributions on percentage 

of annual earnings of employees or final average pay of employees. That information would be 

detailed in Alight contracts and other plan documents responsive to the DOL’s requests. If those 

sensitive, highly confidential compensation metrics were disclosed, there is nothing that would 

prevent a competitor of Alight’s clients from reverse engineering the compensation provided to 

Alight’s client’s employees and using that information to lure away key employees. For this 

reason, many of Alight’s clients are very protective of their benefits and compensation information 

and rely on Alight to keep that information confidential. 

9. Furthermore, Alight is concerned about the possible security threats its clients 

would face if information about the client’s retirement plans, most notably details about the 

security and access protocols for the plan, are disclosed. The DOL’s requests seek a wide-range 

of documents including investigation reports detailing Alight’s clients’ decisions on security and 

account access and potential gaps or deficiencies, contracts discussing the services the plans 

receive and detailing plans’ security decisions, and information about the benefits that Alight’s 

 

1 Alight’s internal data systems segregate retirement plans by the category of services provided, not by 

their legal definition (e.g. ERISA Plans, Supplemental Employee Retirement Plans, Church Plans, etc.). 

While not all of the plans listed are ERISA Plans, a significant number of them are ERISA Plans. 

DocuSign Envelope ID: 57B3FC90-C60C-45A7-B25D-CE9A3882BEB1 Case: 1:20-cv-02138 Document #: 31 Filed: 11/17/21 Page 3 of 10 PageID #:407
4

clients provide to plan participants.

10. Alight and its predecessor Hewitt Associates LLC has required multi-factor 

authentication and minimum password standards for all recordkeeping clients since 1998. In 2012, 

Hewitt Associates LLC began requiring a third authenticator for retirement plan financial 

transactions over a client-defined amount (default is $3,000). In 2018, in response to an evolving 

threat landscape, Alight began the process of systematically eliminating the use of personal and 

work email to transmit one-time codes (used for multi-factor authentication) and for facilitating 

password reset requests.

11. Beyond these baseline security requirements, at any point in time, Alight has 

offered a range of security and access options from which its clients can choose to implement in 

their plans, including features such as biometric authentication, password expiration, or features 

related to the specificity of information necessary to confirm a plan participant’s identity (e.g. 

requiring full or partial social security numbers). There are a number of appropriate and valid 

reasons why a particular plan fiduciary may choose to implement or not implement certain security 

features. For example, if the demographics of the plan’s participant pool is older or has a lack of 

experience utilizing security tools implemented through smart phone technology, a plan fiduciary 

may decide to offer secure access options tailored to that population. 

12. Beyond Alight’s baseline security controls, Alight does not have the authority to 

force a client to accept any or all of Alight’s security protocols. To the contrary, it is the client’s 

responsibility, as the plan’s fiduciary, to determine what security options will best serve their plan 

participants and, thus, which security services to enable for the plan. The contract and terms would 

then detail the client’s decisions on how to set up the plan’s security and access protocols. Because

each client’s security and access protocols are tailored to the client fiduciary’s choices, the public 

DocuSign Envelope ID: 57B3FC90-C60C-45A7-B25D-CE9A3882BEB1 Case: 1:20-cv-02138 Document #: 31 Filed: 11/17/21 Page 4 of 10 PageID #:408
5

disclosure of those security and access decisions would essentially give bad actors a road map of 

which plans to target and how. If a plan’s security or access controls are disclosed or otherwise 

become compromised, illicit third-parties could easily identify the plans that the bad actors 

consider to be the most vulnerable to their tactics and create targeted schemes designed to 

circumvent those security features.

13. As a provider of recordkeeping services, Alight is further entrusted with sensitive 

and highly confidential plan participant data including: names, contact information (including 

home address, phone numbers, and e-mail addresses), social security numbers, asset information, 

investment information, beneficiary information, contribution levels, bank account and other

financial account numbers in combination with a password, PIN, knowledge of answers to security 

questions or a security code that could permit access to a participant’s account and potentially lead 

to identity theft. In Alight’s experience, the majority of unauthorized access incidents are 

attributable to identity theft occurring outside of Alight’s environment, specifically when 

participants’ email accounts and/or personal devices are compromised through phishing attacks 

and/or malware. Therefore, limiting the number of locations of sensitive, client identifying 

information is of paramount importance to Alight as it seeks to protect its clients and their plan 

participants from cybersecurity and fraud threats.

14. One of the categories of documents that the DOL has requested in their Subpoena 

is investigation reports of cybersecurity and fraud incidents along with all corresponding 

communications related to those investigations. To date, these investigation reports make up more 

than half of the over four hundred documents produced to the DOL so far. These investigation 

reports contain highly sensitive details about Alights’ clients and their plan participants, including 

details about the plans’ security and access as well as highly confidential details about the plan 

DocuSign Envelope ID: 57B3FC90-C60C-45A7-B25D-CE9A3882BEB1 Case: 1:20-cv-02138 Document #: 31 Filed: 11/17/21 Page 5 of 10 PageID #:409
6

participants which can include, but is not limited to, social security numbers, contact information 

(addresses, phone numbers, e-mail addresses), asset information and banking information. The 

disclosure of this PII, especially in conjunction with the disclosure of plan security controls, 

therefore, creates a significant security threat as it provides bad actors not only with a road map to 

circumvent the plans’ security measures but the plan participant information necessary to gain 

access to the account. 

15. In addition to sensitive PII, these investigation reports will sometimes contain

embarrassing and/or dangerous details about the plan participant’s role in the incident. In nearly 

every instance, Alight investigates allegations involving external threats of fraud perpetrated 

against the plan participants directly that do not involve a gap or failure on Alight’s system. These 

investigation reports detail Alight’s findings and would include a discussion of how a plan 

participant was susceptible to the tactics of bad actors (e.g. through an online romantic relationship 

or similar highly-personal tactic or certain family dynamics). The disclosure of these details, 

inadvertent or otherwise, would not only be embarrassing to the plan participants and, in some 

cases, their spouses and families, but it would also serve as an advertisement to bad actors on

which plan participants have previously fallen prey to their tactics. 

16. The DOL also seeks confidential settlement agreements that Alight entered in with 

clients related to potential unauthorized access and disbursements with respect to client accounts. 

Alight did not enter any of these agreements as a fiduciary to any plan, nor did Alight exercise any 

fiduciary authority over any of the plans. To the contrary, these settlement agreements are 

explicitly limited to Alight’s role as a non-fiduciary recordkeeper. Regardless, these settlement 

agreements often involve multiple parties, all of whom entered into the settlement agreement under 

the condition that the terms of the settlement agreement remain confidential. Alight, therefore,

DocuSign Envelope ID: 57B3FC90-C60C-45A7-B25D-CE9A3882BEB1 Case: 1:20-cv-02138 Document #: 31 Filed: 11/17/21 Page 6 of 10 PageID #:410
7

cannot unilaterally overrule the express intent of all of the various parties to the agreement. 

Further, all of these agreements contain explicit confidentiality clauses that memorialized the 

parties’ intent that the agreement remain confidential. In addition to being a clear violation of the 

agreements’ confidentiality clauses, the disclosure of these settlements to the DOL would 

discourage future parties from entering into settlement agreements with Alight on these issues to 

the detriment of not only Alight but its clients and plan participants. 

17. Alight is contractually obligated to protect the confidentiality of their client plans’

and their plan participants’ sensitive and confidential information. While Alight’s contracts vary 

from client-to-client, every contract contains a “Confidential Information” provision that 

designates, as confidential: (a) the terms of the agreement (including Schedules and other 

attachments to the Agreement); (b) Client Information;2(c) oral and written information 

designated by a party as confidential prior to the other party obtaining access thereto; and (d) oral 

and written information that should reasonably be expected to be treated as confidential by the 

recipient whether or not such information is designated as confidential. Moreover, our contracts 

affirmatively state that the client’s confidential information will remain the client’s sole and 

exclusive property.

18. While each contract Alight enters into with its clients is unique, Alight’s contracts 

each contain a confidentiality provision that requires Alight to exercise reasonable efforts to 

minimize distribution and duplication and to prevent unauthorized disclosure of the client’s 

 

2 While Alight’s contracts vary from client-to-client, Client Information is typically defined as “all data, 

information, images, text, content or materials (in whatever form or media) that are owned by Client, or 

licensed by third parties to Client including: (a) Participant Data; (b) Client’s standard materials and 

derivations thereof; (c) Client’s methodologies, techniques, templates, flowcharts, architecture designs, 

tools, specifications, practices, processes, inventions, formulae, models, samples, records and 

documentation, concepts, and know-how; and (d) all other materials or information in which Client has 

Proprietary Rights.”

DocuSign Envelope ID: 57B3FC90-C60C-45A7-B25D-CE9A3882BEB1 Case: 1:20-cv-02138 Document #: 31 Filed: 11/17/21 Page 7 of 10 PageID #:411
8

confidential information. Alight’s contracts generally require Alight to limit disclosure of client 

and plan participant information to those who have a need to know the confidential information 

and that this information will not be disclosed without the client’s consent. 

19. Alight is not permitted to disclose a client’s sensitive and confidential information 

without notice and, in many cases, the client’s consent, even in response to a subpoena. Many of 

Alight’s contracts further permit the client to withhold consent for any reason or condition without

the execution of a confidentiality agreement reasonably acceptable to the client. Alight’s contracts, 

however, do allow Alight to use de-identified plan or plan participant data for any purpose 

provided that no data is identifiable to any third party as relating to the plan participant, plan or 

client. Alight has currently reached out to our clients regarding the DOL’s subpoena in anticipation 

of making further productions in response to the DOL’s requests. 

20. Upon reviewing the enforcement petition, I am aware that the DOL alleges in 

Paragraph 3 of the declaration in support of the enforcement petition (“Loggins Allegations”) that 

Alight: (1) “processed unauthorized distributions as a result of cybersecurity breaches relating to 

its ERISA plan clients’ accounts;” (2) “failed to immediately report cybersecurity breaches and 

the related unauthorized distributions to ERISA plan clients after its discoveries;” (3) “failed to 

disclose cybersecurity breaches and unauthorized distributions to its ERISA plan clients for 

months, if at all;” and (4) “failed to restore the unauthorized distribution amounts to its ERISA 

plan clients’ accounts.”

21. Alight was, and remains, surprised by the allegations contained in the Loggins 

Allegations. Prior to the enforcement petition, the DOL never shared these allegations or concerns

with Alight. Alight is unaware of any factual situation that meets any of the criteria outlined in 

the Loggins Allegations. 

DocuSign Envelope ID: 57B3FC90-C60C-45A7-B25D-CE9A3882BEB1 Case: 1:20-cv-02138 Document #: 31 Filed: 11/17/21 Page 8 of 10 PageID #:412
9

22. While Alight has yet to identify any incidents that match the Loggins Allegations, 

Alight has repeatedly requested that the DOL identify the ERISA Plans referenced in the Loggins 

Allegations so that Alight can take immediate steps to ensure the safety of its clients and their plan 

participants, including: communicating with the client, placing freezes on accounts that may be 

compromised, and working with law enforcement to supplement its investigation. Alight further 

committed to investigate the alleged incidents and remediate any identified issues resulting from 

Alight security deficiencies and to share its findings with the DOL. If the DOL’s allegations are 

correct, it is in everyone’s best interest – the plan participant(s), the ERISA Plan(s), the DOL and 

Alight – for Alight to investigate and remediate the issues as soon as possible. 

23. Alight has further offered to provide the DOL with unredacted documents, 

including communications, contracts, and investigation reports related to the incidents referenced 

in the Loggins Allegations incorporated into DOL’s Motion to Enforce. Alight maintains that this 

proposal is in the best interest of all parties involved. It provides the DOL with all of the 

information surrounding the specific incidents that prompted the DOL’s investigation, it helps 

Alight identify whether there are any issues that require remediation so as to better protect our 

clients, and it minimizes risk of disclosure for all of Alight’s clients’ plan participants. To date, 

the DOL has steadfastly refused to provide the identity of the ERISA Plans or plan participants

referenced in its Motion to Enforce.

* * *

Pursuant to 28 U.S.C. § 1746, I certify under penalty of perjury under the laws of the United 

States of America that the foregoing is true and correct to the best of my knowledge, information, 

and belief. 

DocuSign Envelope ID: 57B3FC90-C60C-45A7-B25D-CE9A3882BEB1 Case: 1:20-cv-02138 Document #: 31 Filed: 11/17/21 Page 9 of 10 PageID #:413
10

November 17, 2021

DocuSign Envelope ID: 57B3FC90-C60C-45A7-B25D-CE9A3882BEB1 Case: 1:20-cv-02138 Document #: 31 Filed: 11/17/21 Page 10 of 10 PageID #:414