SEC files charges in brokerage hacking case

Securities Privacy, Cyber Risk & Data Security SEC Enforcement

On August 15, the SEC filed a complaint against 18 individuals and entities (collectively, “defendants”) in the U.S. District Court for the Northern District of Georgia for allegedly engaging in a fraudulent scheme in which online retail brokerage accounts were hacked and improperly used to purchase microcap stocks. According to the SEC, the defendants collectively acquired substantial shares of the common stock of two public microcap companies. After obtaining the shares, some defendants conspired with other unknown parties to subject various retail brokerage accounts, held by third-party investors, to online account takeover attacks. The hacked accounts then were forced to make large purchases of the companies’ common stock, thereby artificially inflating the trading price and volume of the stocks. The defendants then sold the shares they had acquired at the inflated prices, generating approximately $1.3 million in proceeds and creating substantial profits for the defendants. The complaint also noted that throughout the scheme, some defendants repeatedly took steps to conceal their beneficial ownership of the company’s shares by, among other things, failing to file with the Commission certain beneficial ownership reports required by law. The SEC’s complaint alleges violations of anti-fraud and beneficial ownership reporting provisions of the federal securities laws, specifically, the Securities Act of 1933 and the Securities Exchange Act of 1934. The complaint seeks a permanent injunction against the defendants, disgorgement of ill-gotten gains, plus interest, penalties, bars, and other equitable relief. According to the SEC Director of Division of Enforcement, the case “illustrates the critical importance of cybersecurity and of our ongoing efforts to protect retail investors from cyber fraud.”