SEC’s own breach
The agency’s leader testifies before a Senate committee.
WASHINGTON — Senators on Tuesday grilled the chairman of the Securities and Exchange Commission — the agency responsible for policing Wall Street — on its handling of a 2016 data breach that was disclosed only last week.
The hack breached the SEC’s system for handling corporate filings intended for investors, known as EDGAR. That has raised concerns that the hackers may have gained advance looks at filings and engaged in insider trading.
The SEC’s disclosure also followed a much larger breach at credit reporting firm Equifax that exposed sensitive personal information belonging to 143 million Americans. Lawmakers also blasted Equifax executives for their delay in disclosing the hack, even as some executives sold shares in the company. Equifax’s CEO stepped down Tuesday.
“I was disturbed to learn that the SEC suffered a cyber-breach of its EDGAR system in 2016, but did not notify the public, or even all of its commissioners, until it was discovered during your recent review,” said Sen. Mike Crapo, RIdaho.
SEC Chairman Jay Clayton told the Banking Committee that the incident “concerns me deeply” and added that he has ordered an investigation by the agency’s inspector general. On Monday the SEC said it had created a new cyber unit that will target market manipulation, hacking and dark-web operatives.
Clayton said he became aware of the attack in August, months after becoming chairman in May. But he couldn’t say when the hack occurred or when an investigation would be completed. He also said he couldn’t guarantee “that this was the only breach that we had.”
Sen. Sherrod Brown, D-Ohio, acknowledged the breach occurred before Clayton took office. But he slammed him for not revealing it more quickly.
Three Equifax executives sold shares worth a combined $1.8 million before the company revealed it had been hacked. Equifax says the executives were unaware of the breach prior to the sales.
Clayton refused to comment when asked if executives at Equifax engaged in insider trading when they sold their shares. He did not confirm or deny that the SEC was investigating the issue.