A United States leading publication, Energywire News released fresh report by the US Securities and Exchange Commission (SEC) bordering on rising cases of cyber frauds perpetrated by internet hackers on leading public companies in the economy.
Only recently, the Central Bank of Nigeria (CBN) gave an indication of its plans to quickly review Nigeria’s cyber crimes and technology risks regulations to fall in line with emerging demands of digital economy driven by Financial Technology (Fintech) firms.
According to the report, a simple but effective hacking scheme funneled nearly $100 million from energy, real estate and financial firms, the Securities and Exchange Commission reported in a rare cybersecurity warning yesterday.
It said fraudsters posed as CEOs or business partners to trick employees at nine publicly traded companies into wiring millions of dollars to accounts controlled by the hackers, the SEC found.
“These were not sophisticated frauds in general design or the use of technology,” the SEC said in its investigative report. “In fact, from a technological perspective they only required creating an email address to mimic the executive’s address.”
The perpetrators often dropped the names of real law firms and attorneys in their fake emails to make them seem more trustworthy.
In a few cases, the impersonators of major vendors weren’t discovered until real suppliers came forward to report missed payments months after the heist began, the SEC reported.
Two of the victim companies each lost more than $30 million, “almost all of which was never recovered,” the SEC noted. One was tricked into wiring away more than $45 million.
The financial regulator urged companies to tighten their accounting practices in response to the string of compromises. The FBI estimates that business email fraud cost the U.S. private sector at least $5 billion over the last five years.
“In light of the facts and circumstances, we did not charge the nine companies we investigated,” Stephanie Avakian, co-director of the SEC Enforcement Division, said in a statement. “But our report emphasizes that all public companies have obligations to maintain sufficient internal accounting controls and should consider cyber threats when fulfilling those obligations.”
The SEC recently updated a 7-year-old cybersecurity guidance to account for shifting online threats (Energywire, Feb. 22).
The latest interpretation of the agency’s cybersecurity rules calls for greater disclosure not just from companies hit by “material” cybersecurity events, but also firms exposed to risk that “may not yet have been the target of a cyber-attack.”
In April, the SEC brought an unprecedented $35 million enforcement case against Yahoo Inc. successor Altaba Inc. for failing to tell investors about a hack that affected hundreds of millions of users.
Tom Finan, director of cyber risk solutions at the insurance and advisory firm Willis Towers Watson, said yesterday’s SEC report underscores the need for organizations to consider the “human element” of their cybersecurity plans, as opposed to focusing on software fixes alone.
“People are going to click on phishing links. They’re going to download that attachment because it looks like it’s from their boss,” he said from the sidelines of a National Cyber Security Alliance conference at the Nasdaq MarketSite in New York. “We’ve gone and done a tremendous amount of work on the technology side: Now we have to do the harder part, which is the people side.”
Finan recommended companies teach employees about the potential consequences of a security slip-up — for starters, “The SEC could come knocking.”
Regulators there are “sending a message” by sharing the results of their latest cybersecurity investigations, he said. “What they’re saying is: ‘We care about your security controls and your technologies to prevent [breaches], but look, here’s a human-originated vulnerability that led to significant losses. We care about this, too.'”
