The US Securities and Exchange Commission was hacked previous year, and information gleaned from the intrusion "may have provided the basis for illicit gain through trading", the agency revealed this week.
Chris Pierson, CSO at electronic payment provider Viewpost, said the SEC breach was especially significant because the SEC's Division of Corporation Finance "spearheaded the requirement that public entities disclose material cybersecurity risks".
It also raises questions about whether there were weak spots within the SEC, an institution tasked with protecting investors and financial markets, that allowed the hackers in.
Clayton said that the SEC has experienced cybersecurity vulnerabilities before, including an incident in 2014 when the inspector general found that certain SEC laptops that may have contained nonpublic information could not be located, and found instances in which SEC employees transmitted nonpublic information through nonsecure personal email accounts. Data from EDGAR, which is used to receive and publish corporate filings to the agency, "may have provided the basis for illicit gain through trading", Clayton said.
The agency says the "software vulnerability. was patched promptly after discovery", and didn't reveal any personally identifiable information.
At least 139 dead after 7.1 magnitude natural disaster strikes Mexico
A firefighter and a rescuer search for survivors in Mexico City after a strong quake hit central Mexico on September 20, 2017 . Until further notice, Mexico City's airport, schools as well as the stock exchange will remain closed.
SEC Chairman Jay Clayton has issued a statement highlighting the importance of cybersecurity to the agency and market participants, and detailing the agency's approach to cybersecurity as an organization and as a regulatory body. But it wasn't until last month that the agency concluded the cybercriminals involved may have used their bounty to make illicit trades.
Clayton said the review of the incident is ongoing with help from "appropriate authorities", but it is not so far believed that the hack went any further and compromised any other SEC systems.
It also puts the agency under a spotlight over why the 2016 breach was not disclosed earlier.
Brad Keller, senior director of third-party strategy at risk management company Prevalent Inc., told SearchSecurity "this suggests is that the SEC, like most companies, doesn't fully understand how the information in its various databases can be used". "We must be vigilant".
Insider trading, which is essentially what hackers are doing if they're using stolen SEC filings to buy and sell stock, can have a huge effect on the supply and demand of a stock, and thus the price.