Recent Sec Actions Highlight the Importance of Implementing Effective Cybersecurity Measures

On January 15, 2019, the United States Securities and Exchange Commission (“SEC”) filed a civil complaint against thirteen individuals and entities for allegedly hacking into the SEC’s EDGAR filing database between May and at least October 2016.  The complaint alleges that the hackers reaped over $4.1 million from trading on information in confidential filings.  SEC Chairman Jay Clayton explained that the action “illustrates that the SEC faces many of the same cybersecurity threats that confront exchange-listed companies, other SEC-registered entities and market participants of all types” and “we recognize that we must continuously use the resources available to us efficiently and effectively to bolster our cybersecurity defenses and reduce our cyber risk profile.”

In the past year, cybersecurity has been a focus for the SEC.  On February 21, 2018, the Commission issued guidance to assist public companies in issuing sufficient disclosures about cybersecurity risks and incidents.  The guidance provides the SEC’s views on public companies’ disclosure obligations under existing law and addresses the application of disclosure controls and procedures, insider trading prohibitions, and selective disclosure prohibitions in the cybersecurity context.  Chairman Clayton stated that he hopes the new guidance will result in “more complete information being available to investors” regarding the cybersecurity risks facing the companies in which they have invested.

On the heels of this guidance, in April 2018, the SEC fined Yahoo! Inc. $35 million for allegedly failing to disclose a data breach affecting 500 million user accounts from 2014 through 2016.  Then, in September 2018, the SEC reached a settlement with Voya Financial Advisors, Inc. pursuant to which the company agreed to pay $1 million for a violation of the Identity Theft Red Flags Rule that led to hackers accessing 5,600 customers’ private information.