The SEC slaps NYSE's parent company with a $10M fine for not immediately reporting a hack

The Securities and Exchange Commission (SEC) has slapped the parent company of the New York Stock Exchange (NYSE), Intercontinental Exchange (ICE), with a $10 million fine for failing to immediately report a hack that affected its systems.

According to the SEC, ICE failed to notify nine of its subsidiaries about a breach of its virtual private network (VPN) system, which occurred in May 2020. The company did not inform its subsidiaries about the breach for several days, which violated SEC regulations that require prompt reporting of such incidents.

The SEC’s fine against ICE is the latest example of the agency’s efforts to ensure that companies take cybersecurity seriously and protect their systems from hackers. In recent years, the SEC has issued several warnings to companies about the importance of disclosing cybersecurity incidents in a timely manner.

ICE’s failure to report the VPN breach was particularly egregious because it put the personal information of its employees and customers at risk. The breach also exposed sensitive financial data, which could have been used for nefarious purposes if it had fallen into the wrong hands.

The SEC’s fine against ICE is a significant development in the agency’s efforts to police cybersecurity practices among publicly traded companies. It serves as a warning to other companies that they must take their cybersecurity responsibilities seriously and report any incidents promptly.

ICE has since taken steps to strengthen its cybersecurity measures and prevent similar breaches from occurring in the future. The company has also agreed to pay the $10 million fine without admitting or denying the SEC’s findings.

The SEC’s action against ICE comes at a time when cybersecurity is becoming an increasingly important concern for companies and regulators. As more businesses move their operations online, they become vulnerable to hacking and other forms of cyber attacks. The SEC has been working to ensure that publicly traded companies take steps to protect themselves from these threats and report any incidents in a timely manner.

In addition to the fine against ICE, the SEC has also issued guidance to companies on how to improve their cybersecurity practices. The agency has recommended that companies establish robust cybersecurity policies, train employees on how to identify and respond to cyber threats, and regularly test their systems for vulnerabilities.

The SEC’s focus on cybersecurity is part of a broader effort by regulators to protect the financial system from online threats. The Financial Industry Regulatory Authority (FINRA), which oversees the securities industry, has also issued guidance on cybersecurity and requires firms to report any significant cyber incidents within 30 minutes of discovery.

The SEC’s fine against ICE is a reminder that companies must take their cybersecurity responsibilities seriously. It also highlights the need for greater transparency and accountability in reporting cyber incidents. By taking a strong stance on these issues, the SEC is helping to protect investors and maintain the integrity of the financial system.

In conclusion, the SEC’s $10 million fine against ICE serves as a warning to other companies that they must take their cybersecurity responsibilities seriously and report any incidents promptly. The SEC’s action is part of a broader effort by regulators to protect the financial system from online threats and ensure that publicly traded companies are taking steps to protect themselves and their customers from cyber attacks.