The Securities and Exchange Commission announced on Sept. 20 that the agency online filing system, where all publicly-traded companies are required to file their financial statements, was hacked in 2016 to facilitate insider trading.
The SEC, which regulates U.S. stock markets, discovered the breach last year, but did not know that the issue may have resulted in illicit trades until August 2017, Jay Clayton, the chairman of the SEC, said in a lengthy public statement on cyber-security published Sept. 20.
The vulnerability occurred in the EDGAR public-records system, which companies use to upload more than 1.7 million financial documents a year, according to the agency. The SEC is currently investigating the incident and has previously prosecuted insider traders that used information from compromised systems to execute trades based on information that wasn’t available to the general public.
A “software vulnerability in the test filing component of our EDGAR system, which was patched promptly after discovery, was exploited and resulted in access to nonpublic information,” he stated. “We believe the intrusion did not result in unauthorized access to personally identifiable information, jeopardize the operations of the Commission, or result in systemic risk.”
The news of the incident comes as the financial world is reeling from the discovery of a massive breach at consumer-information firm Equifax, which allowed online intruders to steal information on 143 million U.S. citizens – data that is critical to the credit-account ecosystem. Both breaches will likely have a dramatic impact on the financial world.
The SEC should expect to be the target of attacks and take measures commensurate with that risk, Joe Fantuzzi, CEO of RiskVision, said in an email to eWEEK.
“Above and beyond simple data theft or monetary breaches, the SEC houses highly critical information such as corporate announcements, product releases, mergers and acquisitions and other financial data that—as in this case—can give perpetrators an edge in stock trading,” he said. “The highly sensitive nature of this data also creates exorbitant amounts of additional risk — which increase significantly with critical vulnerabilities embedded in the network for years or when the data isn’t properly secured.”
The SEC released the information about the breach in a brief press release and as part of a longer statement on the agency’s cyber-security efforts. SEC Chairman Clayton also reportedly briefed some members of Congress.
“Cyber-security is critical to the operations of our markets and the risks are significant and, in many cases, systemic,” Chairman Clayton said in the press release. “We must be vigilant. We also must recognize—in both the public and private sectors, including the SEC—that there will be intrusions, and that a key component of cyber risk management is resilience and recovery.”
While the SEC did not disclose the exact nature of the vulnerability, known software issues are a common source of insecurity, Travis Smith, principal security researcher at data-security firm Tripwire, said in an email to eWEEK.
“As with most breaches, this highlights the importance of promptly installing patches for known vulnerabilities,” he said.