SEC Issues $1 Million Identity Theft Rule Fine

The Securities and Exchange Commission recently settled with Voya Financial Advisors, Inc. for alleged violation of Regulation S-ID (otherwise known as the Identity Theft Red Flags Rule) and Regulation S-P (otherwise known as the Safeguards Rule).  According to the SEC, Voya had failed to implement a written identity theft program as required of broker-dealers and investment advisors by the Identity Theft Red Flags Rule, and failed to have written policies and procedures to protect customer records and information as required by the Safeguards Rule. Specifically, in April 2016 intruders impersonated Voya independent contractors and contacted the company's technical support line. They asked for a reset of the contractors' passwords, which support staff did, giving them temporary passwords over the phone. The bad actors used these credentials to gain access to the company's proprietary web portal. The portal contained personally identifiable information of Voya