SEC fines financial services firm for losing client money in two unrelated cyberattacks

The Securities and Exchange Commission (SEC) has fined Equiniti Trust Company, formerly known as American Stock Transfer & Trust Company, for losing $6.6 million of client funds in two separate cyberattacks. The company agreed to pay $850,000.

SEC and Equiniti settled charges for failing to protect client securities and funds against theft or misuse.

Two separate cyber intrusions occurred in 2022 and 2023. Since then, the company recovered $2.6 million of lost funds and fully reimbursed clients for their losses.

In September 2022, an unknown threat actor hijacked a preexisting email chain between the company and its client, a US-based public issuer. The threat actor pretended to be an employee at the issuer and instructed the firm to issue millions of new shares of the issuer, liquidate those shares, and send the proceeds to an overseas bank.

According to the SEC’s order, American Stock Transfer followed these instructions and transferred approximately $4.78 million to bank accounts located in Hong Kong. The company recouped $1 million of this loss.

In an unrelated incident around April 2023, an unknown attacker created fake accounts using stolen Social Security numbers. The fake accounts were automatically linked to the firm’s real clients solely based on the Social Security number matches. The fraudulent accounts did not have correct names or other personal information.

“This allowed the threat actor to liquidate securities held in the legitimate accounts and transfer a total of approximately $1.9 million in proceeds to external bank accounts, of which American Stock Transfer was able to recover approximately $1.6 million,” the SEC’s press release said.

Monique C. Winkler, Director of the SEC’s San Francisco Regional Office, said cyber intrusions are a near-constant threat to companies and markets.

“As threat actors become more sophisticated in the cyber space, transfer agents must act to implement and maintain effective safeguards and procedures around client assets,” Winkler noted.

Equiniti is a global provider of transfer agent services, equity plans, corporate action, and other services for public and private companies and mutual funds.