(Photo: Shutterstock)

A lone participant in Estee Lauder's 401(k) plan is suing her formeremployer and the service providers to its retirement plan for the $99,000 that was stolenfrom her account.

In October 2016, the plaintiff, who had been separated fromEstee Lauder for about a decade but still had an account balance inthe $1.4 billion plan, began receiving a series of lettersconfirming payments from her account on company letterhead.

Related: Do investment advisors need a modelcybersecurity rule?

Two letters confirmed distributions of $37,000 and $50,000,which were sent to accounts at SunTrust Banks and TD Bank.

A third unauthorized distribution of $12,000 was noted on theplaintiff's account statement. That distribution was neverconfirmed to the plaintiff, according to court documents.

The complaint says the plaintiff never authorized thedistributions and never held accounts at the three banks where thedistributions were wired.

Between October 24, 2016, and January 2, 2017, the plaintiffmade 23 calls to the plan's recordkeeper, Alight Solutions, whichwas then branded as Aon Hewitt.

The Hewitt Customer Service Center said it would investigate thedistributions. Upon completion of the investigation, no money hadbeen recovered, and the plaintiff was told her account would not bemade whole. Alight is a named defendant in the suit.

State Street, which was a custodian and investment manager tothe Estee Lauder plan, did file forgery affidavits from theplaintiff. State Street is a named defendant in the complaint.

According to the complaint, "none of the Defendants contactedher (the plaintiff) prior to the distributions to obtain herauthorization to make the distributions, and none of the Defendantsnotified her of the distributions by any means other than themailed Confirmations of Payment and third-quarter accountstatement, until she telephoned the customer service center."

The lawsuit alleges the defendants violated their fiduciaryobligations under the Employee Retirement Income Security Act.

Under one allegation, the defendants breached their fiduciaryduties by allowing the plan to make unauthorized distributions,failed to confirm the requests for the money, failed to providetimely notice of the distributions by phone or email, failed toidentify suspicious requests that were wired to different bankaccounts, failed to have in place processes to safeguard againstunauthorized withdrawals, and failed to monitor the distributionprocess.

A second allegation under ERISA claims the defendants failed tocomply with the plaintiff's requests for plan documents in a timelyfashion.

The plaintiff is seeking $99,000 plus lost investment earningsfrom the time of the distributions, and the $110-per day that ERISAprescribes as the fine on delays in distributing requested plandocuments. The plaintiff is also seeking to recover legal fees.

READ MORE:

• Keeping clients' data safe
• 8 steps to protect employee benefits data fromhackers
• One year later: The influence of Equifax and otherdata breaches on corporate culture