Shareholder-tracking company Equiniti shells out $850K to SEC over breaches

According to the Securities and Exchange Commission, the company’s failures led to the loss of $6.6 million in client funds.

A company that manages registered shareholders for stock-issuing companies agreed to pay $850,000 under a settlement with the Securities and Exchange Commission over breaches in 2022 and 2023 that the commission said led to the loss of $6.6 million in client funds.

The SEC said that in 2022 an unknown attacker hijacked an email chain between a client and Equiniti, formerly known as American Stock Transfer, and fooled the firm into transferring nearly $4.8 million to Hong Kong bank accounts. In 2023, according to the agency, another unknown attacker created fake accounts that linked to real client accounts and then transferred $1.9 million to external bank accounts.

In the second case, the attacker was able to make the transfers “even though the names and other personal information associated with the fraudulent accounts did not match those of the legitimate accounts,” according to the SEC. Stolen Social Security numbers abetted the theft.

“American Stock Transfer failed to provide the safeguards necessary to protect its clients’ funds and securities from the types of cyber intrusions that have become a near-constant threat to companies and the markets,” Monique C. Winkler, director of the SEC’s San Francisco regional office, said in a statement this week. “As threat actors become more sophisticated in the cyber space, transfer agents must act to implement and maintain effective safeguards and procedures around client assets.”

Equiniti was able to recover funds in both incidents — $1 million and $1.6 million respectively.

“The SEC was satisfied with the swift and decisive actions taken by Equiniti, which included making all client and shareholders whole, and this settlement concludes its investigation,” the company said in a statement to CyberScoop. “Equiniti has and continues to make significant investments into its business and technology to ensure client and shareholder assets are well protected from fraudulent activity.”

The SEC has stepped up its regulation and scrutiny of cyber. Last month, though, a judge threw out most of the agency’s case against SolarWinds over allegedly misleading statements about the security of its Orion software surrounding the landmark breach of that company.

This story was updated Aug. 22, 2024, with comments from Equiniti.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure