Hacking to Trade on Stolen Information: The Earnings Release Had a Secret Audience

Traders who rely on hacking to trade on stolen information gain access to confidential corporate news before the public receives it. An earnings announcement reaches a newswire, hackers steal it, and traders act while everyone else waits for publication. If you work with corporate releases, account activity or trading instructions, you may know how the announcement reached an audience it was never meant to have.

This page follows the information, accounts and payments in the SEC’s newswire hacking allegations. Our broader insider trading page examines the duties and information sharing behind other trades on confidential news.

What Information Was Stolen and How Was It Used?

The stolen information was corporate earnings news that traders allegedly used before its public release. In its August 11, 2015 announcement, the Securities and Exchange Commission charged 32 defendants with participating in a scheme that allegedly generated more than $100 million in illegal profits. The Commission described two Ukrainian hackers supplying information to other defendants who traded on it.

The Securities and Exchange Commission alleged that the hackers broke into two or more newswire services and stole hundreds of corporate earnings announcements over a five-year period. They created a secret web-based location to pass the stolen data to traders. The traders allegedly used the information to trade stocks, options and other securities before publication.

The company’s release process supplied the opportunity. In the Commission’s example, the issuer had already sent its announcement to a newswire, but the newswire had not yet released it publicly. For someone working on that handoff, the important interval begins while the announcement is already outside the company and still confidential.

How Did the Information Reach the Trade?

The Securities and Exchange Commission alleged that the hackers used the secret web location to deliver stolen releases to traders and sometimes received a share of the trading profits. Its account of the complaint describes proxy servers used to mask the hackers’ identities and intrusions concealed by posing as newswire employees and customers. The alleged deception reached the service holding the announcement before the information reached the trading account.

The Commission alleged that the hackers recruited traders with a video demonstrating that they could steal earnings information before publication. If you saw those communications, you may recognize the pitch. The stolen preview came with a demonstration.

The Commission alleged that some traders gave the hackers access to their brokerage accounts so the hackers could monitor trading and check their share of the profits. We see hackers insisting on honest accounting for stolen information.

The Commission’s account also describes traders establishing multiple accounts in a variety of names and sending money to hackers as supposed payments for construction and building equipment. It included trading in contracts for difference among the alleged concealment methods. Someone who understood those payments could connect an ordinary-looking equipment description to the trading profits it allegedly concealed.

How Fast Could the Trading Happen?

Trading could begin within minutes of a company sending confidential news to its newswire. The Securities and Exchange Commission’s account of the complaint gives a specific example from May 1, 2013: a company sent an announcement lowering its earnings and revenue projections, with a 36-minute interval between the newswire’s receipt and public release. Traders allegedly began selling the stock short and selling contracts for difference ten minutes after the company sent the release. The Commission alleged that they realized $511,000 in profits when the stock price fell following the announcement.

For an employee who knows when the release arrived or who could access it, that knowledge can place a trading instruction inside the period when the announcement was still confidential. The company’s bad news had reached the trading accounts first.

What Can Reveal Trading on Stolen Information?

Evidence of trading on stolen information connects the announcement’s contents and access history to communications, accounts, orders and payments. The newswire hack-to-trade allegations show why those connections matter: the information traveled through one channel, the trades through another, and payments back to the hackers could carry a different description altogether. We examine those communications and transaction records with the person who understands what happened inside the business.

A corporate reporting or newswire employee may know which announcement was held, when it arrived and how someone gained access. A person on the trading side may know who passed along the information, who controlled the accounts or why an order went in before the announcement. Those accounts of the work can connect a confidential file to a particular trade.

The payment trail adds another connection. In the Securities and Exchange Commission’s allegations, access to brokerage accounts let the hackers check the profit share they expected, while equipment descriptions concealed payments to them. If you know what a payment actually bought, you may be able to explain the relationship between participants whose records otherwise tell different stories.

How Was the Scheme Detected?

The Securities and Exchange Commission said it used analytical tools to identify suspicious trading patterns and expose the misconduct. The agency’s account put market analysis and the information intrusion inside the same investigation.

An insider can help explain the work behind a pattern. Someone familiar with the release process may recognize which account access was unexpected or what an unpublished announcement contained. Someone familiar with the trades or payments may explain how the participants dealt with each other. We connect that knowledge to the timing and transactions the SEC can examine.

Why Was the Unpublished Release Worth Stealing?

The unpublished release gave the alleged traders advance knowledge of news that could change the stock price. A 2018 Wisconsin Law Review paper, Insider Trading and the Integrity of Mandatory Disclosure, explains the broader problem with exploiting that interval. Its analysis of periodic disclosure argues that companies need time to analyze and verify financial information, and that trading ahead of its release can undermine the purpose of making that information available to investors.

The paper’s argument helps explain the harm in the newswire allegations: company news meant for investors became a private advantage before publication. The alleged traders received the company’s own announcement while the public still waited. An employee who knows the release’s contents and intended publication time can explain exactly what that private preview supplied.

Whistleblower Awards for Information About the Trading

The Securities and Exchange Commission’s whistleblower program can reward information about securities fraud like this. Under its award rules, eligible whistleblowers can share awards totaling 10% to 30% of qualifying monetary sanctions collected when the action results in more than $1 million in sanctions. We assess the reporting opportunity with you, starting with what you know about the stolen information and the people who used it.

A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers. Securities trading reports use the SEC’s separate program, and we work with you on the award opportunity tied to your information.

When You Know Who Got the News Early

If you know how an unreleased announcement reached a trader, or why a payment went back to its source, speak to one of our Whistleblower Experts about how the news got out early. We build your strongest securities whistleblower case with you around the access, accounts and transactions you understand, and bring in securities fraud whistleblower lawyers who know hacking and trading evidence. We stay beside you from that first conversation through the pursuit of your whistleblower award.