Could your data be hacked? Unfortunately, every organization — including for-profit businesses, not-for-profits and government agencies — is vulnerable to cyberattacks today.
Examples abound. In September, Equifax reported a data breach that exposed the credit histories and other information of 145.5 million Americans. Shortly thereafter, the Securities and Exchange Commission (SEC) reported a hacking incident that occurred in 2016.
These incidents have raised concerns from individuals and lawmakers about delays in reporting breaches. However, breach response requires a delicate balance. Organizations that are hacked have a responsibility to make a measured, comprehensive assessment of the situation before reporting a breach to the public at large. Here are details of the SEC breach incident and guidance for victim-organizations on how (and when) to report a data breach.
SEC Announces Breach
In September, SEC Chairman Jay Clayton announced that the agency was expanding a probe into a 2016 data breach of its electronic filing system, known as EDGAR (short for Electronic Data Gathering, Analysis and Retrieval). The investigation will primarily focus on a review of when agency officials learned that the EDGAR system had been hacked. The FBI and U.S. Secret Service have also launched investigations into the breach.
What exactly is EDGAR? It’s the electronic filing system that the SEC created to increase efficiency and accessibility to corporate filings. Most publicly traded companies must submit documents to the SEC using EDGAR. However, some smaller companies may be exempt from these EDGAR mandates if they don’t meet certain thresholds.
Examples of documents that the SEC requires companies to file through EDGAR include annual and quarterly corporate reports and information pertaining to institutional investors. This time-sensitive information is often critical to investors and analysts.
Hackers Exploit Outdated System
EDGAR was launched in the 1990s, and it’s been routinely updated and modified over the last two decades. Like many legacy systems, however, EDGAR has some weaknesses and glitches, and the system will eventually need to be replaced.
In September 2016, the SEC awarded a $6.1 million contract to a firm to collect information needed to completely redesign EDGAR. The SEC anticipates that the information-gathering phase will extend through March 2018. A further extension may be requested to provide additional support for the redesign.
Based on the SEC’s preliminary investigation, it appears that hackers were able to breach EDGAR by using authentic financial data when they were testing the agency’s corporate filing system. The breach occurred in October 2016 and was reportedly detected that month. The cyberattack appears to have been routed through a server in Eastern Europe.
The SEC’s enforcement division discovered the breach as part of an ongoing investigation. Although SEC Chair Clayton was vague on the details, he admitted, “Information they gained caused them to question whether there had been a breach of the system.”
Furthermore, it’s not entirely clear what kind of information was breached. Corporate filings contain detailed financial information about company performance, but such information is usually available to investors in press releases prior to SEC disclosure. According to industry insiders, one potential target could be Forms 8-K. These are unscheduled filings regarding material events that companies are legally required to disclose. These disclosures in EDGAR begin before the official word gets out to the rest of the world.
Media sources say that the FBI’s investigation has homed in on trading activities conducted in connection with the breach. One possibility is that the EDGAR breach is connected to a group of hackers that intercepted electronic corporate press releases in a previous case handled by the FBI team.
SEC Chair Clayton, who took office in May 2017, claims to have first learned of the breach in August 2017. Although he didn’t blame his predecessors, Clayton can’t guarantee that there haven’t been other breaches. “I cannot tell you with 100% certainty that this is the only breach we have had,” Clayton said, reiterating that the investigation was “ongoing.”
Plan Ahead
Data breaches are an inevitable part of today’s interconnected, technology-driven world. How an organization responds to a breach can set it apart from others and affect its goodwill with stakeholders.
Proactive organizations don’t wait for a breach to strike, however. Work with your legal and forensic accounting professionals to help prevent and detect breaches, as well as to establish policies and procedures for investigating and responding to suspected hacking incidents.
