The US Securities and Exchange Commission (SEC) announced on Wednesday that Intercontinental Exchange (ICE) has agreed to pay a $10 million fine to settle charges related to a hacker attack that occurred in 2021.
ICE, described as a foundational part of the global financial system, operates the New York Stock Exchange (NYSE) and other exchanges. The company learned from a third-party in April 2021 that one of its VPNs was hacked through the exploitation of a zero-day vulnerability.
The hackers planted malicious code on the VPN device, which had been used for remote access to the company’s corporate network.
While the targeted VPN has not been named, one zero-day that made headlines in April 2021 was CVE-2021-22893, which at the time was exploited against Pulse Secure customers.
ICE’s investigation into the incident revealed days later that the intrusion was limited to the targeted VPN device.
However, the SEC was displeased that ICE failed to immediately notify legal and compliance officials at NYSE and eight other subsidiaries of the incident, which prevented the subsidiaries from properly assessing the hack to fulfill their independent disclosure obligations.
The SEC said it should have immediately been notified and provided with an update within 24 hours, unless the company had immediately concluded that the cyberattack had no or minimal impact on operations. Instead, it took ICE several days to inform subsidiaries.
The SEC said ICE has agreed to pay a $10 million fine without admitting or denying the agency’s findings.
An ICE spokesperson said in a statement sent to SecurityWeek, “This settlement involves an unsuccessful attempt to access our network more than three years ago. The failed incursion had zero impact on market operations. At issue was the timeframe for reporting this type of event under Regulation SCI.”
Two SEC commissioners issued a statement on the decision, calling it a “disproportionately large penalty”.
*Updated with statement from ICE and the SEC commissioners’ comments
Related: SEC Investigating Progress Software Over MOVEit Hack
Related: SEC Says Companies Must Disclose Cybersecurity Incidents Within 4 Days
Related: FCC Fines Wireless Carriers for Sharing User Locations Without Consent
