Client Alert: SEC’s Approach to Enforcement After Cyber Incidents: Key Takeaways for Public Companies from a Recent Speech

SEC Enforcement Action Following a Cyber Incident Is a Heightened Risk

Grewal acknowledged that, whatever its precautions, a company will experience cyber incidents. As Grewal noted at the outset of his remarks, “cyber resilience is a concept that recognizes that breaches and cyber incidents are likely going to happen, and that firms must be prepared to respond appropriately when they do. In other words, it’s not a matter of if, but when.”^[2]

Despite the inevitability of these incidents, Grewal exhibited little sympathy for companies that mishandle reporting obligations when faced with the crisis of responding to a cyber incident. He stated that he had “zero tolerance for gamesmanship around the disclosure decision.”^[3] He advised executives to disclose concerns about a data breach to the SEC “sooner rather than later”—even if you only “think you might” have a material event to disclose—and regardless of whether your company has finished its internal investigation into the incident.^[4]

Grewal emphasized that, when there are cyberattacks on publicly traded companies, the SEC considers the investing public to be potential victims of those incidents. Decisions made within companies regarding whether to disclose a cyber incident can affect the company’s customers, whose personal identifying information may have been compromised, or the company’s investors, who need to be apprised of material information. And when delayed disclosure leads to increased risk to the public, the SEC may come knocking.

Grewal’s rhetoric is consistent with the SEC’s increasingly aggressive approach to enforcement actions involving cyber incidents. For instance, earlier this year, the SEC settled charges against Blackbaud, Inc., a data management company, in connection with misleading investors about the scope of a ransomware attack.^[5] Over the course of three months, the company initially indicated that the attack had not involved certain information about donors, then learned through its technology and customer personnel that such exfiltration had occurred, and ultimately disclosed the full scope of the attack.^[6] The SEC required the company to pay $3 million in penalties despite the relatively short timeframe in which the company made its complete disclosures regarding the attack and the absence of a finding that the company acted intentionally.^[7]

Today, the SEC appears even more willing to expand the scope of liability involving cybersecurity incidents. For instance, in the case of SolarWinds Corporation—whose ubiquitous network management software was found to be compromised in 2020—the SEC has taken the unprecedented step of signaling enforcement actions against both the company and its senior executives. The SEC recently issued formal notifications, known as Wells Notices, to the CFO and CISO of SolarWinds, alerting them of potential civil enforcement actions stemming from the SEC’s investigation into the cyberattack.^[8]

The SolarWinds investigation will be one to watch to gain more insight into the SEC’s enforcement trends, but as of now, the SEC appears ready to hold executives within public companies accountable for data breaches and related disclosures and controls issues. Executives managing cyber risk will want to tread with caution and review their insurance policies to ensure their coverage in the event of fallout from a cyber incident.

Companies Need to Enhance Policies Designed to Prevent Cyber Incidents and Err on the Side of Careful Disclosure When They Occur

Grewal urged companies to update their cybersecurity policies to keep up with evolving threats, to ensure that the right information is passed up the chain to executives making disclosure decisions, and to disclose major cybersecurity incidents immediately after they happen. As Grewal noted, the SEC has previously sued companies for having deficient disclosure controls and procedures relating to cyber incidents.

In one example Grewal cited, the SEC charged First American Financial Corporation, a title insurance company, with disclosure controls and procedures violations related to a cybersecurity vulnerability that exposed sensitive customer information.^[9] There, company IT personnel identified the vulnerability but failed both to fix it and to report it to senior executives. Months passed, and First American disclosed the vulnerability only after a reporter brought it to the company’s attention.

In another example, the SEC charged Pearson, an educational publishing company, with misleading investors about a cyber intrusion involving the theft of personal data regarding student records.^[10] In public statements, Pearson had referred to a data-privacy incident as a hypothetical risk (even though the breach had already occurred), disclosed the incident only after being contacted by the media, and later understated the severity of the incident. Although the SEC’s settlement reflected negligence-based charges against the company and acknowledged that the right information had not passed up the chain to those making disclosure decisions, Grewal referred to this case as an example of gamesmanship around disclosure decisions and warned that penalties in future cases would be higher.^[11]

Grewal’s speech signals that the Enforcement Division is approaching public companies’ responses to cyber incidents with increasing skepticism and will not hesitate to bring enforcement actions. As companies face increasingly sophisticated cybersecurity threats, companies should ensure that their cybersecurity policies are continuously updated, and that their disclosure decisions about cybersecurity incidents reflect careful, well-substantiated, and documented judgment.

Conclusion

Responding to news of a cyber vulnerability or a data breach is difficult enough. The risk of an SEC enforcement action against your company or officers only adds to the problems. Companies should consult with counsel who are familiar with both cyber risk management and SEC enforcement to ensure that they are prepared for cyber incidents and are able to respond appropriately when one occurs.

Jenner & Block will continue to monitor the regulatory landscape surrounding the SEC and cybersecurity.