The U.S. Securities and Exchange Commission confirmed on Wednesday that hackers were able to breach its EDGAR test filing system last year to access sensitive documents on corporate dealings and disclosures.
The SEC believes hackers breached its EDGAR test filing system and used the information for illicit gain through trading.
The cyber attack on the SEC's dummy test filing system, which is aimed at helping people get used to filing forms with the SEC, is the second such major breach that a top U.S. corporate entity has suffered.
Earlier this month, credit rating agency Equifax announced that it has suffered a massive data breach that directly or indirectly compromised sensitive details of as many as 143 million U.S.citizens. It later turned out that the agency could have avoided the breach had it applied a security patch to its systems when it was made available.
In SEC's case, hackers exploited a vulnerability in the SEC's EDGAR test filing system which stores data on corporate filings, mergers, disclosures, and acquisitions. The cyber attack, which took place in 2016, allowed hackers to gain access to sensitive corporate information which had not been released to the public till then. The hackers then went on to use the information to perform trading, thereby gaining huge returns.
The said vulnerability was patched soon after it was discovered, but not quickly enough as the SEC now admits. In a recent statement to the press, Jay Clayton, the SEC Chairman, said that while the intrusion may have given the hackers an added advantage, it did not succeed in compromising any publicly identifiable information, jeopardize the operations of the Commission, or result in systemic risk.
'Cybersecurity is critical to the operations of our markets and the risks are significant and, in many cases, systemic. We must be vigilant. We also must recognize—in both the public and private sectors, including the SEC—that there will be intrusions, and that a key component of cyber risk management is resilience and recovery,' he said.
Tony Rowan, Chief Security Consultant at SentinelOne, believes that last year's cyber-attack was specifically targeted at the SEC. Such cyber-attacks are conducted so that hackers can gain large chunks of information which they can then use for personal benefit.
Rowan adds that in order to stop the menace of cyber attacks on financial institutions and those holding sensitive corporate secrets, there should be a worldwide coordinated effort so that the perpetrators can be caught and brought to justice, wherever they are.
'The security industry is working on the technical controls to make the prevention, detection and technical responses better and faster. Personally, I think it makes sense to concentrate that effort on the endpoint devices (laptops, desktops, and servers) as they are the devices accessing and processing the information assets. But we need to look to international cooperation between governments to make sure that the attackers pay the proper price,' he adds.
Image source: SBNation