Defendant charged in required scheme to Hack SEC Filing System, Steal Financial Info
U.S. Authorities have charged "a suspected Ukrainian computer user and several traders" with an attempt to cash in on "market-floating corporate revenue", which was stolen from the Securities and Exchange Commission systems, Reuters reported Tuesday.
There are 10 defendants charged two of who are facing criminal charges, Reuters wrote. The incident in question concerns a 2016 breach of the SEC's database of electronic data collection, analysis and recycling (EDGAR), the company's filing system. Reuters wrote:
The government said the scheme resulted in $ 4.14 million of illegal trading gains and wondered about regular investors.
… Authorities said Oleksandr Ieremenko, 26, and Artem Radchenko, 27, both Kiev, used a Lithuanian server to hack into Edgar and get thousands of "test filings," including 157 revenues, and shared their findings with traders.
The Ministry of Justice said conspirators sent fake emails to SEC employees who appeared to be from other employees, allowing Ieremenko and Radchenko to steal the filing through phishing attacks and by installing malicious software on SEC computers.
The Ukrainian men in the case, Ieremenko and Radchenko, face 16 charges, including data mining, fraud and conspiracy. The SEC also filed related civil charges against "six people and two companies in the US, Russia and Ukraine", claiming that they shared in the benefits of the scheme and in some cases shared their poor winnings with Ieremenko, Reuters added.
As the Washington Post noted, listed companies use EDGAR to publish, often hours before the potentially market-changing information contained therein, is disclosed. It seems to have made it an attractive target. According to the Wall Street Journal, prosecutors say a key error in EDGAR allowed the hackers to bypass a login screen and gain direct access to "test filings", "documents that serve to verify that companies have access to the system." Most of these are empty, but some companies sent reports containing actual, valuable data to the test filing system, Journal wrote. In other cases, they used phishing techniques, including constituting SEC security personnel to infect SEC systems and further probe the network.
In the trial, the record wrote that prosecutors described a way that the defendants allegedly profited from their system breach:
In one case, a non-named company sent a document to the SEC at 3:32 which included unresolved quarterly financial results, according to the criminal complaint. About six minutes later, the release was stolen from Edgar. Between 3:42 pm and 3:59 p.m. that day, the hackers bought about 121,000 shares in the company's stock, worth about $ 2.4 million. The company released the accounts to the public at 4:02. The hackers sold the shares the next day after having pocketed more than $ 270,000 in profits, the complaint said.
In another incident that was marked by Journal, the prosecutors said that the ieremenko group received a test submission from a Nasdaq listed company just eight minutes after it was uploaded, just made $ 307,000 by betting against the shares after it had ended 12 percent for the day.
According to the journal, prosecutors are also preparing charges against Ieremenko and accomplices for alleged engagement in a 2010-2015 scheme to steal the company's press releases. Ieremenko emerges prominently in SEC court papers from 2015 as one of the alleged hackers central to the scheme, meaning that the alleged EDGAR burglary occurred after he had already attracted the agency's ire.
The SEC was severely criticized for first noticing the breach in 2016, but only publicly disclosing it in 2017, when they realized that stolen information had been used in industries. As the post mentioned, there has long been controversy within the SEC and legal scholars as to whether it has the legal authority to pursue cases like this, because the hackers were not connected to all the companies involved. They could argue that the crime was not insider trading and thus fall outside the SEC's jurisdiction.
"Public trading companies know that if they were hacked, the trial would move and the SEC could investigate," Stanford University professor and former SEC commissioner Joseph Grundfest told the journal. "But when the SEC is hacked, nothing happens on behalf of the commission, and all the fingers point to the hackers instead."
John Reed Stark, a former SEC representative teaching cyber security law at Duke University, told the Post SEC "must have felt an extraordinary amount of pressure to bring this case" and "I think they are spot-on."
[Reuters]
