SEC Breach Disclosure Should Spur Government, Businesses to Better Protect Data, Warner Says

A disclosure by SEC Chairman Jay Clayton that its filings system was hacked last year shows better efforts are needed by government and businesses to protect sensitive information, said Sen. Mark Warner, D-Va., co-founder of the bipartisan Senate Cybersecurity Caucus, in a Thursday statement. An agency Wednesday news release said Clayton indicated the commission learned the 2016 incident "may have provided the basis for illicit gain through trading." The SEC said the software vulnerability in EDGAR (Electronic Data Gathering, Analysis, and Retrieval) was patched. The hack allowed nonpublic information to be stolen, but not personally identifiable information. Warner intends to question Clayton, scheduled to appear at a Senate Banking Committee SEC oversight hearing Tuesday, "about the effectiveness of current SEC thresholds for requiring companies to disclose a cybersecurity breach." Warner said fewer than 100 of about 9,000 publicly listed companies have reported a material breach to the commission since 2010 despite a "flurry" of high-profile breaches. Warner said he's finalizing a bipartisan bill to establish a national data breach notification standard. Equifax recently announced personal data of 143 million Americans was compromised (see 1709140014 and 1709110035).