The Securities and Exchange Commission (SEC) recently issued an
order imposing a $1 million penalty and remedial sanctions against
Voya Financial Advisors, Inc. (VFA), an entity registered as both a
brokerdealer and an investment adviser, for violations of the
cybersecurity requirements of the Safeguards Rule and the Identity
Theft Red Flags Rule. This is the first SEC enforcement action
charging violations of the Identity Theft Red Flags Rule since the
agency began enforcing the rule in 2011.
According to the SEC, over six days in April 2016, intruders
called VFA's technical support line, impersonating actual
contractors, and were able to receive contractors' user names
and reset their passwords for access to VFA's computer systems
and applications via its web portal. The intruders were able to
gain access to the personally identifiable information (PII) of at
least 5,600 customers and to create new customer profiles. Although
no known unauthorized transfers of funds
