Securities Litigation

A week after OCIE announced it would conduct a second round of cyber-security exams, the Commission emphasized the issue by bringing an enforcement action against a non-custodial investment-adviser over a remediated data breach that caused no customer harm. The adviser used a third-party-hosted web server, on which was stored the personally-identifiable information ("PII") of about 100,000 people, including the firm's 8,400 customers. The server suffered a cyber-attack and data breach in July 2013. The firm responded by retaining multiple consultants, investigating the ...