Non-public Financial Data Leaked Following a Breach in SEC's EDGAR System

SEC Chairman Jay Clayton has revealed a breach in the Commission's Electronic Data Gathering, Analysis, and Retrieval (EDGAR) system which occurred sometime in 2016. The compromise reportedly granted the hackers behind it unauthorized access to non-public market data, thus creating favorable trade opportunities for those who caught a glimpse of the leaked financial information before everybody else.

The premature exposure of financial information was made possible through a flaw in EDGAR's test mode which, if exploited, unlocked non-public data. At first, the intrusion did not seem to have reached personally identifiable information, according to Clayton's expansive statement on Sep. 20, 2017 which outlined the Commission's efforts in combating cybersecurity risks. Subsequent analyses, however, disproved this theory. On Oct. 2, 2017 the SEC revealed that the 2016 EDGAR hack had exposed the personal details of at least two individuals who are now both provided with identity theft protection by the agency's staff.

The 2016 breach has triggered an internal investigation which aims to find what lies at the root of the problem. It has also urged the agency's team to work on mitigating cybersecurity risks as hackers are showing no signs of slowing down. The measures being taken range from performing thorough examinations of the current security systems to bringing in external expertise and workforce to keep safe each and every process, system, and network within the SEC.

Although the 2016 compromise seems to be the catalyst for SEC's recent risk mitigation endeavors, it is by far not the first time the agency has been under attack. A report issued by SEC Inspector General Carl W. Hoecker revealed that dozens of agency laptops had disappeared off the face of the Earth, with many others having incorrect user and/or location details. Since a considerable part of the 5,500+ agency PCs generally contain non-public information, the report assumed that some of the missing machines may store such data, as well.