SEC Discloses MFA Disabling and False Post
The Securities and Exchange Commission (SEC) revealed that multi-factor authentication (MFA) on its X account was disabled prior to a false post about the approval of spot Bitcoin ETFs. The incident occurred when the SEC’s @SECGov X account was compromised, and unauthorized posts regarding the ETF approval emerged.
SIM Swap Attack
An SEC spokesperson stated that the unauthorized party gained control of the agency’s cell phone number associated with the account through a “SIM swap” attack. This technique allows transferring a person’s phone number to another device without authorization. The SEC confirmed that the access to the phone number occurred via the telecom carrier, not its systems.
Multi-Factor Authentication Disabled
Multi-factor authentication had been disabled on the @SECGov X account at the staff’s request due to access issues. It remained disabled until after the account was compromised. Currently, MFA is enabled for all SEC social media accounts that offer it.
SEC Reassures Public Amid Cybersecurity Breach
The SEC assured the public that there is no evidence of the unauthorized party gaining access to its systems, data, devices, or other social media accounts. The agency emphasized its commitment to cybersecurity obligations and stated that it does not use social media channels for public announcements.
Hot Take: SEC Takes Action on Social Media Security
The recent cybersecurity breach at the SEC highlights the importance of implementing strong security measures, such as multi-factor authentication. By disabling MFA on its X account, the SEC left itself vulnerable to unauthorized access and false posts. While no evidence of system breaches has been found, this incident serves as a reminder for organizations to prioritize cybersecurity and regularly assess their security protocols. The SEC’s commitment to providing updates and taking necessary remedial measures demonstrates its dedication to addressing concerns and ensuring the security of its social media accounts.
By
By
By
