Pierluigi Paganini September 22, 2017

The top U.S. markets regulator SEC announced a security breach, accessed data might have been used by crooks for insider trading.

The U.S. Securities and Exchange Commission (SEC) announced that cyber criminals had previously breached its database of corporate announcements in 2016 and likely they have used it for insider trading.

On Wednesday, the SEC Chairman Jay Clayton released a “statement on cybersecurity” that reported a 2016 security breach of its EDGAR system.

The Securities and Exchange Commission’s Edgar filing system is a platform which houses detailed financial reports on publicly traded companies, including quarterly earnings and statements on acquisitions.

A general exterior view of the U.S. Securities and Exchange Commission (SEC) headquarters in Washington, June 24, 2011. REUTERS/Jonathan Ernst

According to Clayton, the security breach was discovered last, it is the result of the presence of  “software vulnerability.”

“In August 2017, the Commission learned that an incident previously detected in 2016 may have provided the basis for illicit gain through trading.  Specifically, a software vulnerability in the test filing component of our EDGAR system, which was patched promptly after discovery, was exploited and resulted in access to nonpublic information.” reads the statement on cybersecurity.

The SEC confirmed it is investigating the security breach but it did not share details about the attack, it only confirmed to have “promptly” fixed the flaw exploited by hackers.

Exactly as for the Equifax incident, this case is hilarious because the SEC agency is charged with protecting investors and markets.

The SEC believes the intrusion did not expose personally identifiable information.

“It is believed the intrusion did not result in unauthorized access to personally identifiable information, jeopardize the operations of the Commission, or result in systemic risk.” continues the statement.

Also in this case, experts pointed out the delay in the disclosure of the security breach.

“The agency detected the breach last year, but didn’t learn until last month that it could have been used for improper trading.” reported the Washington Post “The incident was briefly mentioned in an unusual eight-page statement on cybersecurity released by SEC Chairman Jay Clayton late Wednesday. The statement didn’t explain the delay in the announcement, the exact date the system was breached and whether information about any specific company was targeted.”

“Notwithstanding our efforts to protect our systems and manage cybersecurity risk, in certain cases cyber threat actors have managed to access or misuse our systems,” Clayton said in the statement.

[adrotate banner=”9″]

Pierluigi Paganini

(Security Affairs – SEC, data breach)

[adrotate banner=”12″]