SEC's X Account Compromised Via Phone Number and Lack of Two-Factor Authentication

Oh, and speaking of a bit of hypocrisy and a whole lot of mismanagement, let's not forget this:

SEC Adopts Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies (SEC Release / July 26, 2023)
https://www.sec.gov/news/press-release/2023-139

The Securities and Exchange Commission today adopted rules requiring registrants to disclose material cybersecurity incidents they experience and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy, and governance. The Commission also adopted rules requiring foreign private issuers to make comparable disclosures.

“Whether a company loses a factory in a fire — or millions of files in a cybersecurity incident — it may be material to investors,” said SEC Chair Gary Gensler. “Currently, many public companies provide cybersecurity disclosure to investors. I think companies and investors alike, however, would benefit if this disclosure were made in a more consistent, comparable, and decision-useful way. Through helping to ensure that companies disclose material cybersecurity information, today’s rules will benefit investors, companies, and the markets connecting them.”

The new rules will require registrants to disclose on the new Item 1.05 of Form 8-K any cybersecurity incident they determine to be material and to describe the material aspects of the incident's nature, scope, and timing, as well as its material impact or reasonably likely material impact on the registrant. An Item 1.05 Form 8-K will generally be due four business days after a registrant determines that a cybersecurity incident is material. The disclosure may be delayed if the United States Attorney General determines that immediate disclosure would pose a substantial risk to national security or public safety and notifies the Commission of such determination in writing. . . . 

But even more disturbing is the SEC's lack of TIMELY and PUBLIC disclosure of the hacking that should have been promptly posted as both an SEC Press Release and as a Statement from Chair Gensler -- so much for the federal regulator's advocacy for "cybersecurity disclosure to investors." Note the two screenshots from sec.gov that were taken on January 10, 2024, at 11:06 am ET:

As I have often noted, the modern-day regulation of Wall Street is less about substance and more about the "marketing" of regulation. Once, regulation was about regulation; but today, it's about likes and posts and thumbs up and smiley faces. How nice that as its X Account is hacked, the SEC still found time to launch an Instagram  account https://www.sec.gov/sec-instagram.

• SEC
• X
• Hack
• BrokeAndBroker
• Bill Singer