The SEC Is Cracking Down On Misleading Cybersecurity Disclosure

What You Need To Know

• The United States Securities and Exchange Commission (SEC) has charged four companies, both current and former public entities, with making materially misleading disclosures regarding cybersecurity risks and intrusions, resulting in nearly $7 million in total penalties.
• The proceedings fall into two categories: Disclosing but omitting material information about cyberattacks (Avaya Holdings Corp. and Mimecast Limited) and failing to update risk factors following a cyberattack (Check Point Software Technologies Ltd. and Unisys Corporation).
• The SEC emphasized that public companies downplaying the extent of a cybersecurity breach "further victimize their shareholders or other members of the investing public by providing misleading disclosures."