Further probing of the 2016 cyberattack of the Securities and Exchange Commission's corporate filing system, EDGAR, has found that a test filing in the EDGAR system accessed by third parties contained the names, birthdates and Social Security numbers of two individuals, according to a Monday statement by SEC Chairman Jay Clayton.
Clayton provided the update as part of the ongoing internal investigation of the hack, which he announced on Sept. 20.
The most recent data on the hack, Clayton said, "is based on forensic data analysis" conducted since Sept. 20 when the intrusion was announced.
Clayton said that SEC staff told him about the new information on Friday, and that "staff are reaching out to the two individuals to notify them and offer to provide them with identity theft protection and monitoring services."
Should the agency uncover additional individuals whose sensitive information may have been accessed, the staff will contact them and offer them identity protection and monitoring as well, he said.
"The 2016 intrusion and its ramifications concern me deeply," Clayton said in a statement announcing the latest information. "I am focused on getting to the bottom of the matter and, importantly, lifting our cybersecurity efforts moving forward."
He noted that while the agency's review and remediation efforts are ongoing and "may take substantial time to complete, I believe it is important to provide new information regarding the scope of the 2016 intrusion and provide an update on the steps we are taking to assess and improve the cybersecurity risk profile of our EDGAR system and of the agency's systems more broadly."
Beyond an internal investigation of the intrusion by the agency's Office of Inspector General and an investigation by the Division of Enforcement into the potential illicit trading resulting from the intrusion, Clayton said three additional steps are being taken.
