Exchange and Subsidiaries Settle Charges for Cyber Reporting Failures

An exchange and its subsidiaries settled SEC charges for failing to timely notify the agency of a systems intrusion.

According to the Order, the exchange was notified by a third party about a potential system intrusion due to a previously unknown vulnerability in its virtual private network. The SEC determined that the exchange did not immediately inform its subsidiaries' legal and compliance officials of code that had been inserted into a VPN device used to access its corporate network. The exchange and its subsidiaries took four days to assess the impact of the intrusion before internally concluding it was a minor event. The SEC found that the exchange and its subsidiaries failed to fulfill their regulatory disclosure obligations under Regulation SCI ("Systems Compliance and Integrity") which requires entities to promptly notify the SEC of cyber intrusions and to provide an update within 24 hours, unless they determine the intrusion had a de minimis impact on operations or market participants.

As a result, the SEC found that the exchange caused the subsidiaries' violations of, and the subsidiaries violated, Rules 1002(b)(1) and 1002(b)(2) ("Obligations related to SCI events").

To settle the charges, the exchange agreed to (i) cease and desist from committing or causing future Reg SCI rule violations and (ii) pay a civil money penalty in the amount of $10,000,000.

SEC Commissioners Hester Peirce and Mark Uyeda criticized the $10 million penalty. In a joint statement, the Commissioners said: "this disproportionately large penalty for failure to report in a timely manner an incident ...  ultimately determined [to be] de minimis, suggests to us that the Commission is more concerned with generating large penalties than with ensuring that important market entities address technological vulnerabilities."