SEC Probing Firms Hit by Massive MOVEit Cyberattack

"SolarWinds was a nation-state attack focused on espionage, whereas MOVEit, because of the nature of the software, had a much broader impact across sectors," said McNicholas, who represents the former CEO of SolarWinds. "We saw it impact health care, financial services or anyone who wanted to send files securely."

McNicholas said the SEC is examining "the timing of notice of the MOVEit breach and how long it took information to get to particular entities," along with ransom demands and payments.

The SEC, which has not made the sweep or its targets public, did not respond respond to a request for comment from Law.com. A company's receipt of a sweep letter does not signal the firm is under investigation, though the agency could later use information gathered in the sweep to bring enforcement actions, or to support its case for more stringent regulation.

Progress Software disclosed in an August SEC filing that the agency had subpoenaed the company as part of a formal fact-finding inquiry into the breach.

"To the extent that staff is investigating Progress, it's likely casting the letters quite widely to try to develop information of the extent of the impact," Longo said. "My expectation is they are trying to get information very broadly to assess whether there are any potential violations they want to pursue."

The inquiry comes amid the SEC's growing interest in protecting investors from cyberthreats. In July, the agency adopted new disclosure rules requiring companies to report breaches that materially impact their business within four days of making that determination.

Longo said she doesn't think the SEC's sweep letters are directly related to the new rules, because it's "looking mainly at activity before they came into effect."

But "one could imagine that once the new rule has been in place for a longer time, there may be more public information routinely disclosed around cyber incidents that could be responsive," she said.

"The new rules spell out to public companies what disclosures are required in those circumstances, So certainly depending on their analysis of the impact of such an event, they may have to make some kind of disclosure about it. The SEC rule is very proscriptive about these disclosures."

The SEC's interest in the MOVEit hack seems broader, covering both how it affected public companies and RIAs.

The commission proposed new cybersecurity risk management rules for RIAs in 2022, and last year announced plans to amend Regulation S-P to require broker-dealers, investment companies, registered investment advisers and transfer agents "to provide notice to individuals affected by certain types of data breaches that may put them at risk of identity theft or other harm."

SEC Chair Gary Gensler said in a statement a year ago that requiring firms covered under the revised rule to notify customers about breaches will "close the gap" in current regulations around cybersecurity. "I believe that these amendments, if adopted, would help customers maintain their privacy and protect themselves," he said.

Longo said the SEC has been transparent and that it believes cybersecurity risk affects every participant in the financial system.

"An incident like the MOVEit hack, because it targeted particularly confidential information, likely raises heightened concerns for the SEC about client and customer information that financial institutions like investment advisers and broker dealers have, and whether the security of such information was affected," she said.

Image: Shutterstock