"NYSE Operator Intercontinental Exchange Gets $10M SEC Fine Over 2021 Hack"

The US Securities and Exchange Commission (SEC) recently announced that the Intercontinental Exchange (ICE) has agreed to pay a $10 million fine to settle charges related to a cyberattack that occurred in 2021. ICE operates the New York Stock Exchange (NYSE) and other exchanges. ICE learned from a third party in April 2021 that one of its VPNs was hacked through the exploitation of a zero-day vulnerability. The SEC noted that the hackers planted malicious code on the VPN device, which had been used for remote access to the corporate network. While the targeted VPN has not been named, one zero-day that made headlines in April 2021 was CVE-2021-22893, which, at the time, was exploited against Pulse Secure customers.  ICE’s investigation into the incident revealed days later that the intrusion was limited to the targeted VPN device. The SEC was displeased that ICE failed to immediately notify legal and compliance officials at NYSE and eight other subsidiaries of the incident, which prevented the subsidiaries from properly assessing the hack to fulfill their independent disclosure obligations. The SEC said that it should have immediately been notified and provided an update within 24 hours unless the company had immediately concluded that the cyberattack had no or minimal impact on operations. Instead, it took ICE several days to inform subsidiaries. The SEC noted that ICE has agreed to pay a $10 million fine without admitting or denying the agency’s findings.

SecurityWeek reports: "NYSE Operator Intercontinental Exchange Gets $10M SEC Fine Over 2021 Hack"