Don't Forget to Report a Breach: A Cautionary Tale

When the Intercontinental Exchange (ICE) identified a breach in its virtual private network (VPN), the organization immediately launched investigation and remediation efforts. However, it was not until four days later that the company reported the breach to regulators, violating not only the Security and Exchange Commission's (SEC) compliance requirements but also the company's own internal cyber incident reporting procedures. This is according to the SEC in its May announcement of a $10 million fine. The question of why ICE delayed reporting the incident was never answered publicly.

The SEC stated: "The SEC's order finds that ICE personnel did not notify the legal and compliance officials at ICE's subsidiaries of the intrusion for several days in violation of ICE’s own internal cyber incident reporting procedures. As a result of ICE's failures, those subsidiaries did not properly assess the intrusion to fulfill their independent regulatory disclosure obligations under Regulation SCI (Regulation Systems Compliance and Integrity), which required them to immediately contact SEC staff about the intrusion and provide an update within 24 hours unless they immediately concluded or reasonably estimated that the intrusion had or would have no or a de minimis impact on their operations or on market participants."

Both ICE and the SEC declined to answer Dark Reading's inquiries, but there are some possible explanations. It is also a cautionary tale for other critical infrastructure organizations that consider bypassing compliance for quicker incident response.

A popular misconception is that enterprises have a cavalier attitude about compliance and think that it is easier to pay the fine and chance the consequences of bad press and lawsuits, rather than file the necessary compliance documents and deal with the outcome of suffering a breach.

"I've never been in a situation or a meeting where someone has seriously said, 'Well, we'll just pay the fine,'" says Fred Rica, a partner at certified public accounting firm BPM Associates. "I think most boards and management committees strive to do the right thing and abide by the rules and regulations that they're bound to."

The challenge remains that nontechnical board members often do not understand cybersecurity implications, while CISOs may struggle to explain threats in business terms. Rica emphasizes the need for boards to ask better questions and be more engaged with cybersecurity issues. 

"The first thing that has to change is, boards need to start asking better questions," he says, adding that the time where boards could pass off cyber threats to the technical team has passed.

"What was sufficient even three years ago probably is not sufficient anymore," Rica says.

In the case of ICE, the VPN attack turned out to have “de minimis impact on their operations or on market participants," the SEC said. While that alone does not change the need to report attacks against critical infrastructure within 24 hours, it could indicate that the company focused on fixing a problem as quickly as possible. Or it simply might mean that the company dropped the ball on what should have been a task that should have been done within 24 hours.

A company that doesn't report a data breach could face greater scrutiny of its cyber insurance policy. Companies with adequate security controls get better rates and terms on their cyber policies, while those with shortcomings face higher rates and less favorable terms, notes Bridget Quinn Choi, an attorney at Woodruff-Sawyer & Co.

In this case, she says, ICE was on top of the incident almost immediately.

"They had a criticality matrix. They had reporting controls, they were looking at the severity, and they fairly quickly went in and found the vulnerability. They found that there was a minor intrusion, and they remediated so quickly," she says. "It wasn't a big deal. So it was a pretty good result from an incident response perspective. The thing that was missing is that in their incident response plan, they had to report within 24 hours if there was a reasonable suspicion of an intrusion. They didn't do it."

Choi notes that while the response was fast, the company had procedural issues.

"Even the SEC came back and said this was de minimis. But it's their second violation," she says. (The company previously violated the SEC's Regulation SCI for failing to have appropriate backup and backup procedures.)

"I think that there's a common misconception that cyber is an infosec issue," she says.

Rather, cybersecurity is a business process that can have a wide-ranging effect on the company, its reputation, and revenue.

"The impact to the company can be wide-ranging," she says. There can be cascading costs, there's regulatory issues, [and] there's a plaintiff's bar that is hungry to get into this game. So it's not just doing things, right? It's doing things right."