A futures commission merchant ("FCM")
settled CFTC charges for failing to enact sufficient
cybersecurity measures and to notify customers of a $1 million
cyber breach.
According to the Order, the FCM, Phillip Capital Inc.
("PCI") failed to implement sufficient cybersecurity and
customer disbursement policies and procedures that ultimately
allowed hackers to access their email systems and withdraw customer
funds. After discovering $1 million in customer funds had been
withdrawn, PCI (i) approved reimbursement of the mistakenly wired
customer funds, (ii) notified the CFTC Division of Swap Dealer and
Intermediary Oversight the day of the fraudulent wire and (iii)
implemented measures to prevent further fraudulent transfers. The
CFTC found that PCI failed to disclose in a timely manner the
material facts of the cyber breach and fraudulent wire to current
and prospective customers.