EDGAR system data may have been used for “illicit gain through trading”
SEC Chairman Jay Clayton has issued a statement highlighting the importance of cybersecurity to the agency and market participants, and detailing the agency’s approach to cybersecurity as an organization and as a regulatory body.
The statement is part of an ongoing assessment of the SEC’s cybersecurity risk profile that Chairman Clayton initiated upon taking office in May. Components of this initiative have included the creation of a senior-level cybersecurity working group to coordinate information sharing, risk monitoring, and incident response efforts throughout the agency. The statement provides an overview of the Commission’s collection and use of data and discusses key cyber risks faced by the agency, including a 2016 intrusion of the Commission’s EDGAR test filing system.
In August 2017, the Commission learned that an incident previously detected in 2016 may have provided the basis for illicit gain through trading. Specifically, a software vulnerability in the test filing component of the Commission’s EDGAR system, which was patched promptly after discovery, was exploited and resulted in access to nonpublic information. It is believed the intrusion did not result in unauthorized access to personally identifiable information, jeopardize the operations of the Commission, or result in systemic risk. An internal investigation was commenced immediately at the direction of the Chairman.
Jay Clayton, SEC
Cybersecurity is critical to the operations of our markets and the risks are significant and, in many cases, systemic,” said Chairman Clayton. “We must be vigilant. We also must recognize—in both the public and private sectors, including the SEC—that there will be intrusions, and that a key component of cyber risk management is resilience and recovery.
The statement also outlines the management of internal cybersecurity risks, including the incorporation of cybersecurity considerations in disclosure-based and supervisory efforts, coordination with other government entities, and the enforcement of the federal securities laws against cyber threat actors and market participants that do not meet their disclosure obligations.
Chairman Clayton wrote:
By promoting effective cybersecurity practices in connection with both the Commission’s internal operations and its external regulatory oversight efforts, it is our objective to contribute substantively to a financial market system that recognizes and addresses cybersecurity risks and, in circumstances in which these risks materialize, exhibits strong mitigation and resiliency.
This is not the first time the SEC has exposed financial data. In 2014, an audit from the SEC’s inspector general found that hundreds of agency laptops could not be accounted for, and many of them may have contained non-public financial market data. But the 2016 breach was the result of a deliberate attack aimed at accessing the EDGAR filing system.
EDGAR is the system that accepts electronic filings of statements from corporations regarding their finances and events or activities that might have an impact on their business. The system also allows the public (including investors and researchers) to access those filings. EDGAR amounts to a huge content management and workflow system, containing data on all manner of publicly traded stocks, bonds, and other securities. It’s intended to ensure that all parties have access to the same information at the same time to minimize the ability of some to take advantage of the release of advance financial information.