The distributions were sent to accounts at SunTrust Bank and TD Bank. Berman did not have accounts at either institution. A third unauthorized distribution of $12,000 was realized only when Berman received her account statement—she never received a letter confirming the third transaction, according to court documents.

Threats to the security of 401(k) assets in an era of heightened cyber criminal activity have been on regulators' radar for several years.

But relatively few instances have been recorded. One media report revealed a participant in a plan administered by Prudential had been pilfered, but the retiree was ultimately made whole without legal action.

Between October 24, 2016, and January 2, 2017, Berman made 23 calls to Estee Lauder's recordkeeper, Alight Solutions, which was then branded as Aon Hewitt. Alight is named as a defendant in the lawsuit, along with Estee Lauder Inc., its Employee Benefits Committee, and the plan's custodian, State Street.

Alight reported to Berman that it would investigate the transactions. Upon completion of that investigation, Berman was told no money was recovered, and that she would not be made whole.

According to the complaint, none of the defendants in the claim sought confirmation from Berman on the transactions.

"Naomi's case is so egregious," said Renaker. "There were apparently no affirmative steps to confirm the distributions. When the second distribution came around, to a different bank, how did that not raise a red flag? To me, that is just common sense."

It is unclear if the distribution requests were made over the phone or online. Renaker began making formal record requests for documents and records of the investigation to the named defendants last March. But no responses were given, said Renaker.

The Labor Department has not issued definitive protocol in steps sponsors and service providers should take to confirm distribution requests.

"This is a tough space to regulate because things are moving so quickly," acknowledged Renaker.

But definitive regulations may not be necessary, she said.

The lawsuit alleges two violations under the Employee Retirement Income Security Act.

"ERISA has very clear guidelines for fiduciaries of ERISA plans," said Renaker. "One of fiduciaries' primary duties is to safeguard plan assets. I don't think we need a regulation that says 'you have to confirm transactions'. Participants' rights are thoroughly protected by the duties of loyalty and prudence. I don't think there can be any dispute that if retirement savings are stolen, there is a fiduciary problem."

Under one allegation in the lawsuit, the defendants breached their fiduciary duties by allowing the plan to make unauthorized distributions, failed to confirm the requests for the money, failed to provide timely notice of the distributions by phone or email, failed to identify suspicious requests that were wired to different bank accounts, failed to have in place processes to safeguard against unauthorized withdrawals, and failed to monitor the distribution process.

The second allegation claims the defendants failed to comply with the plaintiff's requests for plan documents in a timely fashion, a requirement under ERISA.

In other ERISA class action claims that have alleged sponsors and service providers failed their fiduciary obligations, service providers have levied a non-fiduciary defense, sometimes pointing to contractual language disclaiming fiduciary status.

"We don't yet know what those agreements say," said Renaker. "But my feeling is State Street is a fiduciary as custodian of those assets. Even if they rely on their relationship with Hewitt (Alight) as the recordkeeper to the plan, that does not seem consistent with their obligations as custodians to the assets. I think all four defendants in the case are fiduciaries."

Renaker does not see her client's case as the kind of "impact litigation" that will force regulatory action. Along with returning the stolen $99,000, the lawsuit seeks lost investment earnings from the time of the distributions, and a $110 per-day fine that ERISA levies for failing to deliver requested plan documents. It also seeks to recover legal fees.

"No, this is not a case I will retire on," said Renaker. "My goal is to protect my client's interests and see her made whole."