The Securities and Exchange Commission (SEC) recently fell victim to a hack that resulted in a false post being shared on its official account. The post claimed that the SEC had approved US spot bitcoin exchange traded funds, causing widespread confusion. However, SEC chair Gary Gensler quickly clarified that the account had been compromised and no approvals had been granted. This incident is a major embarrassment for Gensler, who has made cyber security a priority during his tenure. The SEC has terminated the unauthorized access to its account and is working with agencies like the FBI to investigate the incident.
According to X, formerly known as Twitter, the compromise occurred when an unidentified individual gained control over a phone number associated with the @SECGov account through a third party. X also revealed that the SEC’s account did not have two-factor authentication, urging all users to enable this extra layer of security. While this hack may be embarrassing for the SEC, it is not as serious as previous breaches targeting the regulator itself.
Cyber security experts have criticized the SEC for its failure to implement two-factor authentication. However, some analysts believe that this disclosure makes sense in light of the commission’s new cyber security rules, which require prompt disclosure of any material cyber security events. X is controlled by Elon Musk, who has been a vocal critic of the SEC. In 2018, Musk reached a settlement with the agency after being charged with securities fraud related to a tweet about taking Tesla private.
The hack occurred just hours before a deadline for the SEC to approve several applications for spot bitcoin exchange traded funds. The false post briefly caused bitcoin prices to rise before quickly reversing once it was debunked. Lawmakers in Washington have called for an investigation into the incident, expressing concerns about its potential impact on the markets. The motive and nature of the hack remain unclear, but experts believe it may have been a case of someone trying to cause embarrassment rather than make financial gains.
Overall, this incident serves as a reminder of the importance of robust cyber security measures and the need for organizations to implement two-factor authentication to protect their accounts.