Regulators call planned SEC financial database a 'treasure trove' for hackers

SEC CAT NMS financial database prompts cybersecurity fears from SROs, NYSE

A lack of clear cybersecurity measures attached to a forthcoming financial database, mandated by the Securities and Exchange Commission, is causing financial self-regulatory organizations to publicly voice their concerns, documents show.

The Consolidated Audit Trail, or CAT, is a proposed national market system that will eventually give regulators an analytical oversight tool to help better track trading activity in the U.S. equity and options market.

“This treasure trove of order and execution information has tremendous commercial value, and we are gravely concerned that cyber criminals and others will seek to access and use it for their personal gain to the detriment of funds and their shareholders,” wrote Investment Company Institute General Counsel David Blass.

Data stored in the CAT will include, information about who is receiving, originating, routing or executing specific trades. A vendor chosen by the SROs will be responsible for eventually constructing and entering data into the CAT for the SEC to access for review.

The SEC did not respond to FedScoop’s request for comment regarding how the commission plans to handle these concerns.

SEC Chair Mary Jo White has previously said “[the database] will significantly increase the ability of regulators to conduct research, reconstruct market events, monitor market behavior, and identify and investigate misconduct.”

The CAT is also expected to, according to the original proposal, cut down on the time SEC regulators must currently allocate to manually enter data and organize it for cases.

Although many groups support the plan, some self-regulatory organizations, or SROs, are skeptical that current plans will provide enough digital security given the high value of economic information that will be stored within the system.

A FAQs page published alongside the commission’s trade information repository plan estimates that there will be approximately 3,000 authorized users with access to CAT data. This would including regulatory staff of the SROs and SEC staff.

The architects of the CAT plan — the National Securities Exchanges and the Financial Industry Regulatory Authority — opened up the project for comment in late April. Last week was the deadline for comments from partnering SROs to submit their reactions.

The New York Stock Exchange, Investment Company Institute and Managed Funds Association all criticized the CAT plan due to lingering, unresolved fears prompted by the online databases’ proposed structure.

“Considering the large number of individuals with access to the Central Repository, the possibility of a security breach that may result in the disclosure of CAT Data, including PII, is a material threat with substantial consequences,” NYSE General Counsel Elizabeth King warned.

Kelvin To, founder and president of big data financial tech firm Data Boiler Technologies, wrote in another comment that the CAT should be monitored for “threats, attacks and anomalous activity” by the National Cybersecurity & Communications Integration Center — a cybersecurity incident response and management division housed within the Department of Homeland Security.

The SEC now has a remaining three months to react to those comments and ultimately approve the CAT plan.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure