Cybersecurity Policy Report, SEC Faces Congressional Heat Over Social Media Hack, (Jan 12, 2024)
The ability of a hacker to take control of the Securities and Exchange Commission’s account on X (formerly Twitter) should be reviewed by the SEC’s inspector general (IG), according to Sens. Ron Wyden (D., Ore.), chairman of the Senate Finance Committee, and Cynthia Lummis (R., Wyo.).
On Tuesday, the SEC’s X account announced that the commission would allow exchange-traded funds to track bitcoin, a significant development that led to a sharp rise in the value of bitcoin. Within 15 minutes, SEC Chairman Gary Gensler posted from his own account that the SEC account had been hacked and the announcement was fraudulent.
“Later that day, X released a statement that the hack involved ‘an unidentified individual obtaining control over a phone number associated with the @SECGov account through a third party,’” Sens. Wyden and Lummis noted in a letter to Deborah Jeffrey, the SEC’s IG.
“X also said that the SEC’s official account did not have multi-factor authentication (MFA) enabled at the time the account was compromised,” according to the letter, which was dated yesterday and released today.
“Given the obvious potential for market manipulation, if X’s statement is correct, the SEC’s social media accounts should have been secured using industry best practices. Not only should the agency have enabled MFA, but it should have secured its accounts with phishing-resistant hardware tokens, commonly known as security keys, which are the gold standard for account cybersecurity,” Sens. Wyden and Lummis said.
The IG has previously warned the SEC about lax cybersecurity, and the SEC’s failure to follow cybersecurity best practices is “inexcusable, particularly given the agency’s new requirements for cybersecurity disclosure,” they said, citing the commission’s new rules requiring publicly traded companies to promptly disclose cybersecurity incidents.
“Additionally, a hack resulting in the publication of material information for investors could have significant impacts on the stability of the financial system and trust in public markets, including potential market manipulation. We urge you to investigate the agency’s practices related to the use of MFA, and in particular, phishing-resistant MFA, to identify any remaining security gaps that must be addressed,” they added.
Information about the incident was also requested by Republican leaders of the House Financial Services Committee, who wrote to Mr. Gensler on Wednesday to request a briefing for committee staff by next Wednesday.
The SEC’s failure to secure its X account is “unacceptable, and it is disturbing that your agency could not even meet the standard you require of private industry,” according to the letter signed by committee Chairman Patrick McHenry (R., N.C.) and the chairs of three of its subcommittees.
“Last year, the SEC adopted a cybersecurity risk management rule requiring companies to disclose within four business days if a ‘material’ cybersecurity incident occurs,” they noted.
“Given yesterday’s tweet, we expect the SEC to hold itself to the same requirements that are imposed on companies throughout the country,” they added. “All market participants deserve transparency from you and your agency.”
News: FederalLegislation DataSecurity