SEC Fines Intercontinental Exchange Inc. $10 Million for Delays in Notifying Agency about Data Breach

On May 22, 2024, the United States Securities and Exchange Commission instituted cease-and-desist proceedings against Intercontinental Exchange Inc. (ICE) and its subsidiaries, including the New York Stock Exchange, for failing to promptly notify the SEC about a cyber intrusion that occurred in April 2021.  Upon learning of a system intrusion involving a previously unknown vulnerability in ICE’s virtual private network (VPN), ICE investigated and immediately determined that a threat actor had inserted malicious code into a VPN device used to access ICE’s corporate network. But ICE personnel failed notify legal and compliance officials at ICE’s subsidiaries of the data breach for several days in violation of the company’s cyber incident reporting procedures and Regulation Systems Compliance and Integrity (Regulation SCI). 

Due to these failures, ICE’s subsidiaries did not properly assess the intrusion as required by Regulation SCI, which requires them to immediately contact SEC staff about an intrusion and provide an update within 24 hours unless they immediately concluded or reasonably estimated that the data breach had or would have no or a de minimis impact on their operations or on market participants.  SEC adopted Regulation SCI) to ensure that national securities exchanges and other covered entities maintain operational capabilities and support the SEC’s mission of protecting investors and maintaining fair and orderly markets. Regulation SCI requires entities to promptly notify the SEC of significant systems issues, including disruptions, compliance issues, or intrusions. Immediate notification is crucial for the SEC to evaluate risks and prevent harm to investors and market integrity.

In its press release announcing its order and $10 million fine, SEC noted that “its order and penalty not only reflect the seriousness of the respondents’ violations, but also that several of them have been the subject of a number of prior SEC enforcement actions, including for violations of Reg SCI.”