SEC announces sanctions against entities over email account hacking

The U.S. Securities and Exchange Commission (SEC) announced sanctions against several organizations over email account hacking.

The U.S. Securities and Exchange Commission (SEC) announced sanctions against eight entities belonging to three companies over email account hacking due to cybersecurity failures. The companies were not able to protect the confidential information of their customers.

“The Securities and Exchange Commission today sanctioned eight firms in three actions for failures in their cybersecurity policies and procedures that resulted in email account takeovers exposing the personal information of thousands of customers and clients at each firm.” reads the announcement published by SEC.

The sanctioned entities are Cetera (Advisor Networks, Investment Services, Financial Specialists, Advisors, and Investment Advisers), Cambridge Investment Research (Investment Research and Investment Research Advisors), and KMS Financial Services.

SEC sanctioned Cetera because it has exposed the personal information of at least 4,388 customers and clients between November 2017 and June 2020 allowing unauthorized third parties to hack into more than 60 cloud-based email accounts belonging to its staff.

The Securities and Exchange Commission also claims that the company did not provide clear information about the attacks in the breach notifications sent to impacted individuals.

The Commission also sanctioned Cambridge Investment Research after 121 email accounts belonging to the company have been hijacked between January 2018 and July 2021. The hack resulted in the exposure of information belonging to at least 2,177 customers and clients. In this case, the SEC claims that Cambridge had failed to take action to improve defense for its email system until 2021.

The last company that was sanctioned was KMS because 15 financial advisers or their assistants had their email accounts hacked between September 2018 and December 2019. The intrusions caused the exposure of information belonging to nearly 5,000 clients and customers. The Securities and Exchange Commission also states that the company failed to implement additional security measures until August 2020.

Cetera will pay $300,000, Cambridge will pay $250,000, and KMS will pay a $200,000 penalty.

“Investment advisers and broker dealers must fulfill their obligations concerning the protection of customer information,” said Kristina Littman, Chief of the SEC Enforcement Division’s Cyber Unit. “It is not enough to write a policy requiring enhanced security measures if those requirements are not implemented or are only partially implemented, especially in the face of known attacks.”

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Securities and Exchange Commission)