Massive Ransomware Attack Necessitates Examination Of Cybersecurity Measures

Beginning on May 12, 2017, unidentified hackers launched a massive cyberattack using ransomware known as "WannaCry" that compromised over 200,000 computers across the world. The attack also disrupted critical business operations, particularly in the UK's National Health Service. The ransomware was used to exploit a vulnerability that affects computers running Microsoft Windows and was first identified by the NSA.

In response to the attack, the SEC Office of Compliance and Examinations ("OCIE") warned registrants to be vigilant in mitigating risk, and noted a recent OCIE study that determined a substantial number of registrants did not (i) conduct periodic risk assessments, penetration tests or vulnerability scans, or (ii) ensure that critical security patches were updated properly. The OCIE directed registrants to its webpage with links to various resources that provide guidance on cybersecurity risk management. In addition, the FBI issued a Bulletin that provides