Cybersecurity Disclosures

“Misleading” Cybersecurity Disclosures Turn Into SEC Fines for SolarWinds Hack Victims

October 29, 2024

Each of the fined companies learned that they had been breached during the SolarWinds hack in 2020 or 2021. Each was found by the SEC to have negligently minimized its cybersecurity disclosures in ways that could mislead investors, but all using somewhat different language.

Wall Street building showing breach reporting failure

Cyber Security News

NYSE Exchange Owner Fined $10 Million Over Breach Reporting Failure

May 28, 2024

ICE has been charged with causing nine of its subsidiaries in total, the NYSE included, to fall afoul of breach reporting requirements as they were not provided the information by their parent company in a timely enough manner.

View of Wall Street buildings showing cybersecurity disclosures

Cyber Security Insights

How New SEC Disclosures Are Shaking up This Year’s Responsibilities

March 8, 2024

Updated federal guidelines emphasize transparency and swift action to safeguard organizations, stakeholders, customers, and their communities. As cybersecurity teams adjust to the government's latest directives, security leaders must prepare and ensure compliance with these new regulations.

Man working at computer showing cybersecurity disclosures and incident response

Cyber Security Insights

New SEC Cyber Disclosure Rules Will Force Companies to Develop Incident Response Plans

January 31, 2024

To many, the new SEC rules that require public companies to disclose “material” cybersecurity incidents within four days of determining their materiality may seem like a challenging, if not unreasonable, demand. Companies should put a priority on preparing incident response plans that will help them meet compliance.

Facade of the Stock Exchange building showing cybersecurity disclosures

Cyber Security Insights

Revisiting the SolarWinds Incident With the Final SEC Cybersecurity Disclosure Rules

September 4, 2023

The SEC has been clear that proper risk management and timely cyber incident disclosures protect investors and other stakeholders. The regulators may make an example out of SolarWinds and its leadership at the time of the Orion incident to set the tone for the importance of software supply chain security.

Wall Street building in downtown New York City showing SEC investigation on SolarWinds and cybersecurity disclosures

Cyber Security Insights

What the SEC’s Investigation of SolarWinds Means for CISOs and Cybersecurity Disclosures

August 25, 2023

This appears to be the first time that the SEC has sent a Wells Notice to a CISO. While novel, this Wells Notice furthers the SEC’s recent enforcement and rulemaking focus on meaningful and timely cybersecurity-related disclosures, as well as holding individual liable for their roles in company violations.

Cybersecurity Disclosures

“Misleading” Cybersecurity Disclosures Turn Into SEC Fines for SolarWinds Hack Victims

NYSE Exchange Owner Fined $10 Million Over Breach Reporting Failure

How New SEC Disclosures Are Shaking up This Year’s Responsibilities

New SEC Cyber Disclosure Rules Will Force Companies to Develop Incident Response Plans

Revisiting the SolarWinds Incident With the Final SEC Cybersecurity Disclosure Rules

What the SEC’s Investigation of SolarWinds Means for CISOs and Cybersecurity Disclosures

Fast Food Restaurant Chain Chick-fil-A Suffers Data Breach from Credential Stuffing Attacks

Cosmetics Giant Estée Lauder Discloses a 10-Month Old Data Breach

Rogue AI Agent Hacks Hugging Face During Security Testing

Ransomware Attack at Coca-Cola’s Fairlife Dairy Company Halts U.S. Operations