8 ms·

SEC Discloses Edgar Corporate Filing System Was Hacked in 2016

250 points by k2enemy 9y ago

dqv 9y ago
I can't see this article as its paywalled. I believe this is the actual statement from the SEC: https://www.sec.gov/news/public-statement/statement-clayton-2017-09-20 https://www.sec.gov/news/public-statement/statement-clayton-...
- elevensies 9y ago
  Thanks. Here is a mirror of the article: http://archive.is/xsniG http://archive.is/xsniG
- pc86 9y ago
  Click "web" under the article title above
zaroth 9y ago
Breaching EDGAR and getting away with trading on the information -- and we are learning about this now?! To be fair, I've used EDGAR and it is <cough> very legacy. So no question it was going to be completely compromised. I'd say the mistake was putting non-public information on it in the first place. The risk assessment for private data exposure was extreme.
- Overtonwindow 9y ago
  Edgar is almost as outdated as the TESS system for patents. I'm surprised someone hasn't "hacked" it long ago. Unfortunately, due to Sarbanes Oxley a lot of that infrination is required to be public.
  - dboreham 9y ago
    Shouldn’t that be “Fortunately...” ?
    - dajohnson89 9y ago
      That really depends on how you feel about the disclosure requirement.
      - zdkl 9y ago
        You're gonna have to explain why one would feel negatively about public disclosure.
        theseatoms 9y ago
        For one it raises the disincentive to go public, likely causing companies to stay private for longer.
        ringaroundthetx 9y ago
        why should someone have to explain that simply because you haven't thought about the existence of a possible other perspective. the united states has protected trade secrets by law far longer than its been on the transparency train. there are reasons for that, and the corporate disclosure requirements has had no effect on creating a "fair market"
        zdkl 9y ago
        I was just asking for an opinion from someone in that camp. Your answer does not give faith in your business practices, as a client or as an investor. I suggest you work on communication, even with strangers on the internet.
  - deleted 9y ago
    [deleted]
piker 9y ago
Sympathy for the SEC on this one. For its faults, EDGAR is an elegant, useful tool for disseminating a massive amount of information. In an effort to be robust in the service of its presumably thousands of poorly-configured clients (academia, hobbyists, day traders, etc.) it's probably trivial to mistake a hostile act for poor programming practices. We've used this system successfully to fuel tons of projects and only on a few occasions been rate-limited despite numerous logic breakdowns, fork bombs, etc. resulting in traffic spikes that would have been easily mistaken by a smaller organization to be DoS attacks. While it's easy to say they should have been more vigilant, they have probably been deliberately permissive in the service of their mandate. Thanks to their patience, our projects have been served. That sort of patience probably leads to overlooking something like this.
- dforrestwilson 9y ago
  What kind of projects?
  - Cut_N_Paste 9y ago
    Check #3 & #4 on his submissions. Btw, hackers accessing this info could possibly explain something I tweeted to them about 10 days ago: https://twitter.com/jeffallen6767/status/907171360769662976 https://twitter.com/jeffallen6767/status/907171360769662976
    - dopamean 9y ago
      Was the SEC notified about the Equifax hack before the public? With enough time for someone to trade on that information?
      - wbl 9y ago
        Yes. Regulation FD says you have to tell everyone material information at the same time.
        9y ago
mobilefriendly 9y ago
Congress should look at the SEC obligations for disclosure (the delay seems wrong given the organization's mission of transparency... the SEC would sanction a public company for a similar failure to disclose) and why the SEC decided to wait a year to inform the public. Not disclosing the hack back in August 2016 strikes me as a political decision by the Obama Administration to avoid criticism during the home stretch of the election.
- iamatworknow 9y ago
  If it was intentionally covered up by Obama's administration, why did Trump's administration wait 9 months to make it public? Not everything has to be politically motivated.
adamnemecek 9y ago
I wonder if the hackers were from the industry or outsiders who just took advantage of the opportunity.
- jfc 9y ago
  Probably both. That's a pretty good-sized arbitrage opportunity. Think about the number of people in the financial world who are looking to get a percentage of a second advantage with high-speed trading. Hard to believe they'd pass this up if they knew about it.
athenot 9y ago
Here's a non-paywalled version: https://www.nytimes.com/aponline/2017/09/21/us/ap-us-sec-cyber-breach.html https://www.nytimes.com/aponline/2017/09/21/us/ap-us-sec-cyb... > The Securities and Exchange Commission says its corporate filing system was hacked last year and the intruders may have used the nonpublic information they obtained to profit illegally. This is the most problematic part.
mifeng 9y ago
I thought EDGAR was only used to disclose public securities filings. What's the big deal?
- debacle 9y ago
  They likely upload the filings some time before they are released.
- metaobject 9y ago
  I believe IPO applications are also handled there.
lgats 9y ago
Facebook Proxy Past Paywall https://www.fullwsj.com/articles/sec-discloses-edgar-corporate-filing-system-was-hacked-in-2016-1505956552 https://www.fullwsj.com/articles/sec-discloses-edgar-corpora...
- deleted 9y ago
  [deleted]
runesoerensen 9y ago
"The U.S. Department of Homeland Security detected five “critical” cyber security weaknesses on the Securities and Exchange Commission’s computers as of January" "The report’s findings raise fresh questions about a 2016 cyber breach into the SEC’s corporate filing system known as “EDGAR.”" "... it shows that even after the SEC says it patched “promptly” the software vulnerability after the 2016 hack, critical vulnerabilities still plagued the regulator’s systems." http://www.reuters.com/article/us-sec-cyber-weaknesses-exclusive/exclusive-u-s-homeland-security-found-sec-had-critical-cyber-weaknesses-in-january-idUSKCN1BW27P http://www.reuters.com/article/us-sec-cyber-weaknesses-exclu...
freefal67 9y ago
As much as the UI appears dated, Edgar is consistently one of the fastest websites I use on a daily basis. Punch in a ticker under "Fast Search" here (https://www.sec.gov/edgar/searchedgar/companysearch.html https://www.sec.gov/edgar/searchedgar/companysearch.html) and click around the filings for a bit to see what I mean.
1024core 9y ago
Is EDGAR data publicly available, as in, can I download the archive for a year?
- et2o 9y ago
  Yes
tannhaeuser 9y ago
How come SEC only discloses this now? Isn't preventing insider trading a goal of financial regulations? If so, is there a reason SEC didn't disclose it as soon as they gained knowledge of the leak? I think this goes to show that any data collection is dangerous, even if government thinks they're the good guys (when in fact they're naively collecting data that could be weaponized against them very easily). The EU is on to it as well with MiFID II granular reporting of financial market transactions starting effectively next year. Though I'm not sure the Brits are going to play along (where the majority of trading happens in Europe); after all, why should they go through the trouble of implementing MiFID/MiFIR when leaving EU anyway? Edit: preventing insider trading
- HolyLampshade 9y ago
  Well, just because this was disclosed to the public now doesn't mean it wasn't previously disclosed to Treasury, FINRA, the US Equity SROs, and the ESMA. The surveillance systems surrounding almost any market center are substantial, and can seek the sort of behavior having inside information might appear as.
  - tannhaeuser 9y ago
    That makes sense, but do we have info on whether that actually happened? Who's overseeing the overseers? The only theory under which it would make sense to withhold that info I can think of are criminal investigation tactics, but there's no actual info on suspect transactions, is there? Broadly and vaguely trusting in surveillance isn't convincing at all. The usefulness of surveillance must be weighed and re-evaluated against risks, as demonstrated by this incident.
    - HolyLampshade 9y ago
      I guess by surveillance I was speaking purely transactional surveillance, and typically investigations into transactional behavior takes time, and under certain circumstances would result in criminal prosecution (on top of any regulatory fines/punishment). It also takes time to coordinate investigating multiple different asset class transactions, in the event, say, equity derivatives are used. And no, we don’t have info on what happened and what was taken, and certainly nothing about any regulatory investigations.
yq 9y ago
paywall workaround: https://www.facebook.com/l.php?u=https://www.wsj.com/articles/sec-discloses-edgar-corporate-filing-system-was-hacked-in-2016-1505956552 https://www.facebook.com/l.php?u=https://www.wsj.com/article...

250 points by k2enemy 9y ago

dqv 9y ago

I can't see this article as its paywalled. I believe this is the actual statement from the SEC: https://www.sec.gov/news/public-statement/statement-clayton-2017-09-20 https://www.sec.gov/news/public-statement/statement-clayton-...

elevensies 9y ago
Thanks. Here is a mirror of the article: http://archive.is/xsniG http://archive.is/xsniG
pc86 9y ago
Click "web" under the article title above

zaroth 9y ago

Breaching EDGAR and getting away with trading on the information -- and we are learning about this now?! To be fair, I've used EDGAR and it is <cough> very legacy. So no question it was going to be completely compromised. I'd say the mistake was putting non-public information on it in the first place. The risk assessment for private data exposure was extreme.

Overtonwindow 9y ago
Edgar is almost as outdated as the TESS system for patents. I'm surprised someone hasn't "hacked" it long ago. Unfortunately, due to Sarbanes Oxley a lot of that infrination is required to be public.
- dboreham 9y ago
  Shouldn’t that be “Fortunately...” ?
  - dajohnson89 9y ago
    That really depends on how you feel about the disclosure requirement.
    - zdkl 9y ago
      You're gonna have to explain why one would feel negatively about public disclosure.
      - theseatoms 9y ago
        For one it raises the disincentive to go public, likely causing companies to stay private for longer.
      - ringaroundthetx 9y ago
        why should someone have to explain that simply because you haven't thought about the existence of a possible other perspective. the united states has protected trade secrets by law far longer than its been on the transparency train. there are reasons for that, and the corporate disclosure requirements has had no effect on creating a "fair market"
        zdkl 9y ago
        I was just asking for an opinion from someone in that camp. Your answer does not give faith in your business practices, as a client or as an investor. I suggest you work on communication, even with strangers on the internet.
- deleted 9y ago
  [deleted]

piker 9y ago

Sympathy for the SEC on this one. For its faults, EDGAR is an elegant, useful tool for disseminating a massive amount of information. In an effort to be robust in the service of its presumably thousands of poorly-configured clients (academia, hobbyists, day traders, etc.) it's probably trivial to mistake a hostile act for poor programming practices. We've used this system successfully to fuel tons of projects and only on a few occasions been rate-limited despite numerous logic breakdowns, fork bombs, etc. resulting in traffic spikes that would have been easily mistaken by a smaller organization to be DoS attacks. While it's easy to say they should have been more vigilant, they have probably been deliberately permissive in the service of their mandate. Thanks to their patience, our projects have been served. That sort of patience probably leads to overlooking something like this.

dforrestwilson 9y ago
What kind of projects?
- Cut_N_Paste 9y ago
  Check #3 & #4 on his submissions. Btw, hackers accessing this info could possibly explain something I tweeted to them about 10 days ago: https://twitter.com/jeffallen6767/status/907171360769662976 https://twitter.com/jeffallen6767/status/907171360769662976
  - dopamean 9y ago
    Was the SEC notified about the Equifax hack before the public? With enough time for someone to trade on that information?
    - wbl 9y ago
      Yes. Regulation FD says you have to tell everyone material information at the same time.
      - 9y ago

mobilefriendly 9y ago

Congress should look at the SEC obligations for disclosure (the delay seems wrong given the organization's mission of transparency... the SEC would sanction a public company for a similar failure to disclose) and why the SEC decided to wait a year to inform the public. Not disclosing the hack back in August 2016 strikes me as a political decision by the Obama Administration to avoid criticism during the home stretch of the election.

iamatworknow 9y ago
If it was intentionally covered up by Obama's administration, why did Trump's administration wait 9 months to make it public? Not everything has to be politically motivated.

adamnemecek 9y ago

I wonder if the hackers were from the industry or outsiders who just took advantage of the opportunity.

jfc 9y ago
Probably both. That's a pretty good-sized arbitrage opportunity. Think about the number of people in the financial world who are looking to get a percentage of a second advantage with high-speed trading. Hard to believe they'd pass this up if they knew about it.

athenot 9y ago

Here's a non-paywalled version: https://www.nytimes.com/aponline/2017/09/21/us/ap-us-sec-cyber-breach.html https://www.nytimes.com/aponline/2017/09/21/us/ap-us-sec-cyb... > The Securities and Exchange Commission says its corporate filing system was hacked last year and the intruders may have used the nonpublic information they obtained to profit illegally. This is the most problematic part.

mifeng 9y ago

I thought EDGAR was only used to disclose public securities filings. What's the big deal?

debacle 9y ago
They likely upload the filings some time before they are released.
metaobject 9y ago
I believe IPO applications are also handled there.

lgats 9y ago

Facebook Proxy Past Paywall https://www.fullwsj.com/articles/sec-discloses-edgar-corporate-filing-system-was-hacked-in-2016-1505956552 https://www.fullwsj.com/articles/sec-discloses-edgar-corpora...

deleted 9y ago
[deleted]

runesoerensen 9y ago

"The U.S. Department of Homeland Security detected five “critical” cyber security weaknesses on the Securities and Exchange Commission’s computers as of January" "The report’s findings raise fresh questions about a 2016 cyber breach into the SEC’s corporate filing system known as “EDGAR.”" "... it shows that even after the SEC says it patched “promptly” the software vulnerability after the 2016 hack, critical vulnerabilities still plagued the regulator’s systems." http://www.reuters.com/article/us-sec-cyber-weaknesses-exclusive/exclusive-u-s-homeland-security-found-sec-had-critical-cyber-weaknesses-in-january-idUSKCN1BW27P http://www.reuters.com/article/us-sec-cyber-weaknesses-exclu...

freefal67 9y ago

As much as the UI appears dated, Edgar is consistently one of the fastest websites I use on a daily basis. Punch in a ticker under "Fast Search" here (https://www.sec.gov/edgar/searchedgar/companysearch.html https://www.sec.gov/edgar/searchedgar/companysearch.html) and click around the filings for a bit to see what I mean.

1024core 9y ago

Is EDGAR data publicly available, as in, can I download the archive for a year?

et2o 9y ago
Yes

tannhaeuser 9y ago

How come SEC only discloses this now? Isn't preventing insider trading a goal of financial regulations? If so, is there a reason SEC didn't disclose it as soon as they gained knowledge of the leak? I think this goes to show that any data collection is dangerous, even if government thinks they're the good guys (when in fact they're naively collecting data that could be weaponized against them very easily). The EU is on to it as well with MiFID II granular reporting of financial market transactions starting effectively next year. Though I'm not sure the Brits are going to play along (where the majority of trading happens in Europe); after all, why should they go through the trouble of implementing MiFID/MiFIR when leaving EU anyway? Edit: preventing insider trading

HolyLampshade 9y ago
Well, just because this was disclosed to the public now doesn't mean it wasn't previously disclosed to Treasury, FINRA, the US Equity SROs, and the ESMA. The surveillance systems surrounding almost any market center are substantial, and can seek the sort of behavior having inside information might appear as.
- tannhaeuser 9y ago
  That makes sense, but do we have info on whether that actually happened? Who's overseeing the overseers? The only theory under which it would make sense to withhold that info I can think of are criminal investigation tactics, but there's no actual info on suspect transactions, is there? Broadly and vaguely trusting in surveillance isn't convincing at all. The usefulness of surveillance must be weighed and re-evaluated against risks, as demonstrated by this incident.
  - HolyLampshade 9y ago
    I guess by surveillance I was speaking purely transactional surveillance, and typically investigations into transactional behavior takes time, and under certain circumstances would result in criminal prosecution (on top of any regulatory fines/punishment). It also takes time to coordinate investigating multiple different asset class transactions, in the event, say, equity derivatives are used. And no, we don’t have info on what happened and what was taken, and certainly nothing about any regulatory investigations.

yq 9y ago

paywall workaround: https://www.facebook.com/l.php?u=https://www.wsj.com/articles/sec-discloses-edgar-corporate-filing-system-was-hacked-in-2016-1505956552 https://www.facebook.com/l.php?u=https://www.wsj.com/article...