Cybersecurity Disclosure and Controls Cases: What Reached Management, What Reached Investors

In cybersecurity disclosure and controls cases, the Securities and Exchange Commission examines what companies told investors, how internal warnings reached disclosure decisions, and whether safeguards protected client securities and money. You may know what the incident report said before management approved a public statement, or why a transfer instruction passed a check it should have failed. Those connections can explain the difference between the business investors saw and the operation you knew from inside it.

This page follows cybersecurity information through public disclosures and securities-transfer controls. The broader securities fraud evidence trail connects investor statements to accounting, contracts and payments across the business.

Yahoo’s Breach Reached Management but Stayed Out of the Filings

Yahoo, later renamed Altaba, agreed to a $35 million penalty to settle SEC charges that it misled investors by failing to disclose a massive data breach. In its April 2018 announcement, the SEC described an information-security team that learned of the theft within days of the December 2014 intrusion. According to the SEC, hackers had taken usernames, email addresses, encrypted passwords and other personal information relating to hundreds of millions of accounts.

According to the SEC’s account of its settled order, information about the breach reached senior management and the legal department. The agency alleged that Yahoo failed to investigate properly or adequately consider disclosure to investors. It also alleged that Yahoo did not share breach information with its auditors or outside advisers assessing disclosure obligations.

The SEC alleged that Yahoo lacked disclosure controls designed to ensure that security-team reports were properly and promptly assessed for disclosure. Its quarterly and annual reports allegedly omitted the breach and its potential business and legal consequences. We see investors left with risk language about a breach management already knew had happened. On paper, it stayed hypothetical.

What Evidence Can Show a Cybersecurity Disclosure Failure?

The useful evidence connects the cybersecurity information available inside the company to the statement investors received. An insider may understand a handoff that the final disclosure never shows.

The SEC’s 2018 cybersecurity guidance described controls that bring technical experts and disclosure advisers into communication. It called for information to move up the company so management could assess the incident’s significance and make disclosure decisions. If you prepared the incident report, you may know what it said and who received it. If you worked on the disclosure, you may know which version reached the people approving the public language.

The content of the report matters alongside its recipients. The Commission’s guidance tied an incident’s significance to the compromised information and the harm to the business. A technical assessment and a finance assessment can explain different consequences of the same breach.

We examine the statement as it read at the time alongside the information then available and the decisions made about it. That includes the difference between a report delivered to management and a report actually assessed for disclosure. Yahoo’s alleged failure sat in that gap: senior people received information, while investors continued to receive risk language.

Disclosure controls carry information into reporting decisions, while accounting controls govern how transactions are authorized and recorded and how assets are tracked. For an insider, the distinction identifies which process to explain: how information reached a filing, or how a transaction entered the books and moved an asset. The SEC’s guidance also addressed board oversight, making board reports another way to compare the oversight investors were promised with what management actually received.

The same guidance addressed risks involving suppliers and service providers, and recognized that cybersecurity incidents can result from unintentional events as well as deliberate attacks. The employee who understands an outsourced function or an internal system failure may therefore know part of the disclosure story.

The SEC’s Equiniti Case Followed False Instructions Into Client Accounts

Equiniti Trust Company, formerly American Stock Transfer & Trust Company, agreed to an $850,000 civil penalty to settle SEC charges over failures to protect client securities and funds from theft or misuse. The SEC’s August 2024 announcement described more than $6.6 million in client losses from separate cyber intrusions. The SEC said American Stock Transfer recovered approximately $2.6 million and fully reimbursed clients for their losses.

A transfer agent maintains registered-holder records and handles authorized issuance and transfers. Authenticating the instruction matters because the instruction can cause shares to be issued, sold and converted into cash. That is the operational connection between an email and an investor’s assets.

In the SEC’s account of the settled order, an intruder hijacked an existing email chain between American Stock Transfer and a public-company client. Pretending to be an employee of that client, the intruder instructed the transfer agent to issue new shares, sell them and send the proceeds overseas. The SEC alleged that American Stock Transfer followed those instructions and transferred the money to bank accounts in Hong Kong.

The other intrusion described by the SEC used stolen Social Security numbers to create fake accounts. According to the SEC, American Stock Transfer automatically linked those accounts to legitimate client accounts solely because the Social Security numbers matched, even though names and other personal information did not. The intruder could then sell securities from the real accounts and send the proceeds to external bank accounts. In the agency’s account, the names failed to match. The money moved anyway.

If you worked with those systems, the instruction history, account-linking logic and transfer records would explain different parts of that path. The email establishes the requested transaction. The account records show whose assets became accessible, and the transfer records show where the proceeds went.

Why Cybersecurity Disclosure and Insider Trading Belong Together

Cybersecurity information can matter to a trader before it reaches the market. The SEC’s 2018 guidance addressed the interval while a company investigates an incident, assesses its significance and prepares disclosure. It identified cybersecurity risks and incidents as potential material nonpublic information and discussed controls against insider trading before investors receive the news.

Insider Trading and the Integrity of Mandatory Disclosure, published in the Wisconsin Law Review in 2018, explains why that interval matters. Its analysis of periodic reporting argues that compiling and verifying information for investors creates an opportunity for insiders to exploit advance knowledge:

For someone involved in an incident review, the distribution of information has a second significance. It can show who had access to the news while investors were still waiting for disclosure. We examine that knowledge alongside the trading records and the responsibilities of the people involved.

What a Whistleblower Adds to the Internal Record

A whistleblower can explain how the company’s information and decisions fit together. You may know why a security report failed to reach the disclosure review, what management received, or how an account became authorized to move someone else’s securities. That explanation gives the documents their business context.

A 2019 working paper hosted by MIT Sloan, Do Corporate Whistleblower Laws Deter Accounting Fraud?, studied accounting fraud at companies exposed to state False Claims Acts through state pension-fund investments. It reported a 5% to 9% reduction in the likelihood of accounting fraud after that exposure. That finding gives us a reason to take the employee’s ability to expose accounting fraud seriously alongside the company’s formal control structure.

We work with you on reporting the securities conduct your information can explain. The SEC’s separate whistleblower program can pay eligible whistleblowers awards totaling 10% to 30% of qualifying sanctions collected. We assess the reporting and award questions with you and securities fraud whistleblower lawyers.

The pension-fund study concerns a different route: False Claims Act cases involving government money. A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers.

You Know What the Security Report Said

If you know what management received, what investors were told or why a false instruction moved client assets, speak to one of our whistleblower experts about what the company knew and did. We work with you to build your strongest securities whistleblower case around the cybersecurity records and decisions you understand, and bring in securities fraud whistleblower lawyers who know disclosure and control cases. We stay beside you as that inside knowledge becomes a case the evidence can support.