Cybersecurity Update: First SEC Enforcement Action Involving The Identity Theft Red Flags Rule Results In Settlement

On September 26, 2018, the Securities and Exchange Commission announced that a settlement was reached in its first enforcement action involving the Identity Theft Red Flags Rule (the "Red Flags Rule"). The Red Flags Rule was designed to protect confidential customer information and customers from the risk of identity theft. The Red Flags Rule requires "financial institutions" and some "creditors" to conduct a periodic risk assessment to determine if they have "covered accounts," and to develop, implement, and administer, an identity theft prevention program that include certain enumerated elements concerning the threat of identity theft.

This case began when the Division of Enforcement brought charges against Voya Financial Advisors Inc. ("VFA") for violating the Red Flags Rule and the Safeguards Rule by failing to correct weaknesses in its cybersecurity policies and procedures, which led to a fraudulent activity and a cyber-intrusion. Notably, several of VFA's