Data Breach

SEC announces it was hacked, information may have been used for insider trading

A general exterior view of the U.S. Securities and Exchange Commission (SEC) headquarters in Washington, June 24, 2011. REUTERS/Jonathan Ernst

The top U.S. markets regulator SEC announced a security breach, accessed data might have been used by crooks for insider trading.

The U.S. Securities and Exchange Commission (SEC) announced that cyber criminals had previously breached its database of corporate announcements in 2016 and likely they have used it for insider trading.

On Wednesday, the SEC Chairman Jay Clayton released a “statement on cybersecurity” that reported a 2016 security breach of its EDGAR system.

The Securities and Exchange Commission’s Edgar filing system is a platform which houses detailed financial reports on publicly traded companies, including quarterly earnings and statements on acquisitions.

A general exterior view of the U.S. Securities and Exchange Commission (SEC) headquarters in Washington, June 24, 2011. REUTERS/Jonathan Ernst

According to Clayton, the security breach was discovered last, it is the result of the presence of “software vulnerability.”

“In August 2017, the Commission learned that an incident previously detected in 2016 may have provided the basis for illicit gain through trading. Specifically, a software vulnerability in the test filing component of our EDGAR system, which was patched promptly after discovery, was exploited and resulted in access to nonpublic information.” reads the statement on cybersecurity.

The SEC confirmed it is investigating the security breach but it did not share details about the attack, it only confirmed to have “promptly” fixed the flaw exploited by hackers.

Exactly as for the Equifax incident, this case is hilarious because the SEC agency is charged with protecting investors and markets.

The SEC believes the intrusion did not expose personally identifiable information.

“It is believed the intrusion did not result in unauthorized access to personally identifiable information, jeopardize the operations of the Commission, or result in systemic risk.” continues the statement.

“It’s hugely problematic and we’ve got to be serious about how we protect that information as a regulator,” said Bill Huizenga, chairman of the US House subcommittee that oversees the SEC.

Also in this case, experts pointed out the delay in the disclosure of the security breach.

“The agency detected the breach last year, but didn’t learn until last month that it could have been used for improper trading.” reported the Washington Post “The incident was briefly mentioned in an unusual eight-page statement on cybersecurity released by SEC Chairman Jay Clayton late Wednesday. The statement didn’t explain the delay in the announcement, the exact date the system was breached and whether information about any specific company was targeted.”

“Notwithstanding our efforts to protect our systems and manage cybersecurity risk, in certain cases cyber threat actors have managed to access or misuse our systems,” Clayton said in the statement.

In July, the congressional watchdog Government Accountability Office published a 27-page report that warned of security issues in SEC systems. Lack of encryption, poorly configured firewalls are just a few non-compliance reported by the watchdog.

[adrotate banner=”9″]

Pierluigi Paganini

(Security Affairs – SEC, data breach)

[adrotate banner=”12″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.