Intercontinental Exchange Fined $10M for Failing to Inform SEC of Cyber Intrusion

The NYSE’s parent company allegedly waited four days before telling nine subsidiaries of the 2021 network breach.

Intercontinental Exchange, the parent company of the New York Stock Exchange, agreed to pay the   Securities and Exchange Commission a $10 million penalty to settle charges that it failed to inform the regulator in a timely manner of a cyber intrusion at nine of its wholly owned subsidiaries, including the NYSE.

According to the SEC’s cease-and-desist order, Intercontinental Exchange was informed in April 2021 that it was potentially impacted by a system intrusion involving a vulnerability in the company’s virtual private network. In addition to the NYSE, the subsidiaries included Archipelago Trading Services, NYSE American, NYSE Arca, NYSE Chicago, NYSE National, ICE Clear Credit, ICE Clear Europe and the Securities Industry Automation Corp.

The SEC said Intercontinental Exchange investigated the matter and immediately determined that malicious code had been inserted into a VPN device used to remotely access the company’s corporate network. However, it alleged the company didn’t notify legal and compliance officials at its subsidiaries about the breach for four days.

The regulator said that this not only violated Intercontinental Exchange’s own internal cyber incident reporting procedures, but it was also in violation of the SEC’s Regulation Systems Compliance and Integrity rule.

Want the latest institutional investment industry
news and insights? Sign up for CIO newsletters.

The regulation requires listed companies to immediately contact the SEC about a cyber intrusion and provide an update within 24 hours, unless they immediately conclude that the intrusion had or would have no or minimal impact on their operations or on market participants.

“The reasoning behind the rule is simple: if the SEC receives multiple reports across a number of these types of entities, then it can take swift steps to protect markets and investors,” Gurbir Grewal, director of the SEC’s Division of Enforcement, said in a statement.

He added that Intercontinental Exchange “failed to notify the SEC of the intrusion at issue as required. Rather, it was Commission staff that contacted the respondents in the process of assessing reports of similar cyber vulnerabilities.”

Intercontinental Exchange and its subsidiaries consented to the SEC’s order finding that they violated the notification provisions of Regulation SCI and that the company caused those violations. Without admitting or denying the regulator’s findings, Intercontinental Exchange and its subsidiaries agreed to the cease-and-desist order in addition to the $10 million penalty.

“This settlement involves an unsuccessful attempt to access our network more than three years ago,” an ICE spokesperson said in an emailed statement. “The failed incursion had zero impact on market operations. At issue was the timeframe for reporting this type of event under Regulation SCI.”

Related Stories:

SEC Settles With Eight Firms Over Inadequate Cybersecurity Measures

SEC Settles Charges with Firm Over Failing to Report Hacking Attempts

JP Morgan Settles SEC Charges It Violated Whistleblower Protection Rule

Tags: , , , , , , , , , , , , , ,

Pension Investors Can Improve the Productivity of the Companies in Which They Invest

Productivity improvements happen across four channels due to direct equity stakes from asset owners, research finds.  

Updated with correction 

New research from the International Centre for Pension Management suggests that direct investments in companies by a pension fund can positively affect the company’s productivity. The findings were released in a white paper titled, “
The Four Ways Through Which Pension Funds Increase the Productivity of Firms They Invest In.” 

The ICPM paper analyzes another recent research paper based on Danish data, which found that pension fund investments can increase a firm’s productivity by 3%-5%. European pension funds, like Canadian ones, are more likely to make direct investments in companies, unlike U.S.-based funds, which typically invest in companies via allocations to private equity managers.  

The paper identifies four “channels” in which a pension fund equity stake influences the productivity of a firm; 

For more stories like this, sign up for the CIO Alert newsletter.

  • Supply of funds: An increased supply of funding may allow a company to make productivity-increasing investments, which it otherwise could not;  
  • Long-term commitment: Because pension funds are such long-term investors, they favor investments with long-term objectives rather than investing in companies with short-term projects and do not have the need to improve margins on a short-term basis, this can allow companies to focus on long-term research and development; 
  • Engagement: An investment from a pension fund tends to improve the governance of a company, through engagements like changing a company’s management and strategy, and taking a seat on the board of a business and providing it expert advice; and  
  • The signaling effect: An investment from a pension fund can give a positive signal to other financiers to also invest, and a firm with a good reputation can attract even further outside investment.  

According to the white paper, a company’s productivity is more affected when a pension fund holds a larger stake in the firm and when that stake is held over a long period of time. The paper notes that because pension funds invest over such a long horizon, their supply of funds, long-term commitment and engagement channels can operate simultaneously with a firm over a long period.  

These synergies, which the paper refers to as “patient capital,” take time to materialize. Other long-term investors, such as insurance firms and sovereign wealth funds, are some of the few investors that might have a similar effect on businesses in which they invest. 

The white paper was written by ICPM’s Working Group, which consists of academic figures and senior officials of several Dutch, Danish and Canadian universities and pension funds such as PSP Investments, APG Asset Management, PGGM, CPP Investments, McGill University, University of Amsterdam, University of Toronto, Copenhagen Business School, PensionDanmark and others. 

Examples in Action 

The white paper provides case studies in which a company’s productivity was increased across all four channels due to an investment from a pension fund. In May 2021, PensionDanmark made a nine-figure investment in cleantech company Stiesdal, a manufacturer of offshore wind foundations, energy storage tech and other clean energy technologies.  

As a result of the investment, Stiesdal had funding for its capital-intensive manufacturing operations, PensionDanmark’s long-term focus meant the business could focus on research and development for new and unproven technologies, which resulted in productivity improvements through the supply of funds and long-term commitment channels. 

The fund’s investment in the company not only provided long-term financial support, but also signaled to other investors and potential customers the company’s potential, representing the signaling effect. PensionDanmark deployed experienced management to the company, holds a seat on the board and improved the company’s governance, which represent improvements through the engagement channel, the paper stated.  

The working group authors of the report include Roel Beetsma, Sebastien Betermier, Jaap van Dam, Svend E. Hougaard Jensen, Felix Lanters, Mark Lyon, Allan Lyngsø Madsen, Michael Neft, Flo Pattiwael, Andrew Reeve, Alexandre Roy, William Scott and Mikhail Simutin. 

Related Stories: 

Pension Investments Boost Corporate Productivity, Study Says 

Chief Information Officers Can Play a Role in Driving Private Equity Returns 

Can the Canadian Model Be Improved? 

Tags: , , ,

«