The Securities and Exchange Commission today filed settled charges against Industrial and Commercial Bank of China Financial Services LLC (ICBC Financial Services) for deficient books and records. The SEC decided not to impose civil penalties against ICBC Financial Services because the company promptly undertook remedial measures and cooperated with the staff’s examination and investigation. According to the SEC’s order, in…
All of that is leading to a broad rethinking of the role of the CISO, says Ken Fishkin, senior manager of information security — essentially the acting CISO — for law firm Lowenstein Sandler LLP. “A lot of people are very nervous about being in a position like mine now because of this responsibility,” he says. “It’s a company issue,…
The increased frequency and severity of cyberattacks has resulted in increased pressure on companies at a global level to prepare for, mitigate against, and disclose the impacts of these attacks. This pressure may be most clearly illustrated by the SEC’s recently adopted rules around incident disclosure. Beyond the SEC, investors have also recognized the increased importance of portfolio companies successfully…
The public company and Chief Information Security Officer Tim Brown, which the SEC named as defendants, are pursuing a rare challenge to the agency’s first-of-its-kind enforcement action, which alleges securities fraud and controls violations. The defendants claim the SEC’s action, if successful, would broaden the agency’s powers and heighten the requirements for publicly disclosing an organization’s cybersecurity posture. “SolarWinds made…
The Securities and Exchange Commission’s new requirements for companies to disclose material cybersecurity incidents take effect on December 18, 2023. The FBI, in coordination with the Department of Justice, is providing guidance on how victims can request disclosure delays for national security or public safety reasons. *** The FBI recommends all publicly traded companies establish a relationship with the cyber…
Accountants should step in to help companies vet whether cybersecurity breaches warrant public reporting under new SEC rules that kick in this month, a top commission official said Tuesday. The cyber reporting rules, adopted in July, give publicly traded companies four days to inform investors of a cyberattack once corporate leaders have determined the breach could materially alter the company’s…
In a move that may set a record for hacking chutzpah, a cyber ransom gang has filed a complaint with the SEC reporting that a company they hacked had failed to report the incident to the SEC within the time required by the agency’s new cybersecurity disclosure guidelines. The gang apparently filed the complaint after the hacked company failed to…
The ALPHV/BlackCat ransomware operation has taken extortion to a new level by filing a U.S. Securities and Exchange Commission complaint against one of their alleged victims for not complying with the four-day rule to disclose a cyberattack. Earlier today, the threat actor listed the software company MeridianLink on their data leak with a threat that they would leak allegedly stolen…
After years of relatively gentle guidance when it came to disclosing cyber risk and cyber breaches, the SEC signaled that the kid gloves had come off when it proposed and ultimately adopted its new cyber disclosure rules. The SEC had also already been signaling its changing enforcement posture, including a 2021 penalty of $500,000 it imposed on American Title Company and a $1 million penalty on…