US Federal prosecutors are charging individuals involved in an international stock-trading scheme that entailed hacking into EDGAR, the Securities and Exchange Commission’s (SEC) corporate filing system.
This scheme reportedly netted the seven fraudsters, who hailed from Ukraine, the US, and Russia, just over $4 million. The group was able to execute trades using nonpublic information from corporate earnings announcements. Most of the filings were “test” filings corporations had uploaded to the SEC’s website.
The group operated from May 2016 to at least October of that year, and they were part of the same group who had previously hacked into newswire services, according to the prosecutors.
Documents stolen included quarterly earnings, merger and acquisition information, and other sensitive news, and the individuals charged were able to see these documents before they were released as a public filing. Members of the charged group executed trades based on the reports and sold them to other traders, with one insider trader making over $200,000 in just one day.
Malicious software that was sent to the SEC via email enabled the hackers to get in. Once they had planted the software on the computers in the SEC, they sent information they were able to get from EDGAR to Lithuanian servers. At the point, the data was used or distributed to other illicit traders.
Two people from Ukraine were charged with hacking the database, Artem Radchenko, and Oleksandr Ieremenko. Seven other entities and individuals have been also named in a civil suit filed by the SEC for trading with illicit information: Spirit Trade Ltd., Ivan Olefir and his company, Capyield Systems, Ltd., Andrey Sarafanov, Sungjin Cho, David Kwon, Victoria Vorochek and Igor Sabodakha.
Consolidated Audit Trail concerns
This incident sparked fears for the Consolidated Audit Trail (CAT) database operated by the SEC. The database is meant to record every order and trade—whether it’s a stock or option, FIX engine or other platforms—made in the US, with the goal being to provide enough data to allow security to detect market manipulations and other illicit behavior.
Full implementation of this database has been plagued by delays, with the reporting for equities now scheduled to start later this year. The New York Stock Exchange has now asked the SEC to consider placing limits on the data CAT is collecting, which is going to include data on the billions of trades placed each day and the personal information of the traders.
In September 2017, the chairman of the SEC announced that EDGAR had been hacked into in 2016. However, according to that announcement, the SEC did not detect the intrusion until August 2017.
Security is now more important now ever
As this incident shows, having strong security in place for your FIX engine and other tech trading tools and platforms is a must in today’s digital world. Your firm must be able to safeguard the information of your clients, and the results of failing to do so can be disastrous.