On September 22, 2015, the US Securities and Exchange Commission
(SEC) announced that an investment advisor firm had agreed to
settle allegations that it failed to adopt written cybersecurity
policies and procedures reasonably designed to safeguard customer
information.
Background
The SEC enforcement action was prompted by an attack by an
unknown intruder on the firm's third-party-hosted web server,
which resulted in the intruder gaining access rights and copy
rights to personally identifiable information pertaining to over
100,000 individuals, including clients of the firm.
While the firm provided notice of the breach and offered free
identity theft monitoring services to all affected individuals,
took prompt remedial action to mitigate against the risk of future
cyber threats, and there was no indication that any client suffered
financial harm as a result of the attack, the SEC instituted
administrative cease-and-desist proceedings, alleging the firm
