In a significant enforcement action, the Intercontinental Exchange (ICE) has been fined $10 million by the Securities and Exchange Commission (SEC) for failing to promptly disclose a cyber intrusion. The penalty underscores the critical importance of timely reporting in maintaining market integrity and security.
The Incident
In April 2021, ICE, the parent company of the New York Stock Exchange (NYSE), was alerted by a third party about a potential system breach involving an unknown vulnerability in its Virtual Private Network (VPN). An immediate investigation uncovered malicious code within a VPN device used for remote access to ICE’s corporate network.
Breach in Protocol
Despite discovering the malicious code swiftly, ICE staff did not inform the legal and compliance teams at its subsidiaries for several days. This delay violated the company’s internal cyber incident reporting procedures and, crucially, Regulation Systems Compliance and Integrity (Reg SCI), which mandates that significant cyber incidents be reported to the SEC within 24 hours.
SEC’s Response
Gurbir S. Grewal, Director of the SEC’s Division of Enforcement, emphasized the gravity of the situation: “When it comes to cybersecurity, especially events at critical market intermediaries, every second counts and four days can be an eternity. Today’s order and penalty not only reflect the seriousness of the respondents’ violations but also highlight that several of them have been the subject of prior SEC enforcement actions, including for violations of Reg SCI.”
Regulatory Implications
This fine serves as a stark reminder of the vital role timely cybersecurity disclosures play in the financial sector. The SEC’s action against ICE not only penalizes the delay but also reinforces the necessity for market operators to adhere strictly to cybersecurity regulations, ensuring that legal and compliance teams are notified immediately of any potential threats.
Looking Forward
The financial industry must heed the lessons from ICE’s costly oversight. As cyber threats continue to evolve, the importance of robust and immediate reporting mechanisms cannot be overstated. ICE’s experience highlights the critical need for all market participants to prioritize cybersecurity compliance and maintain rigorous internal protocols to safeguard market integrity.
In conclusion, the $10 million fine against ICE underscores a pivotal lesson for all market operators: in the realm of cybersecurity, time is of the essence, and adherence to regulatory requirements is paramount.
