The SEC cybersecurity review centers on two linked events: new corporate cyber disclosure rules and the SEC's own social account hijack. The entry point was an apparent SIM swap of the @SECGov phone number, the impact was a false bitcoin ETF approval post that moved the market, and the lesson was disabled multifactor authentication. A material incident here means a cybersecurity event important enough to influence an investor decision. Under the SEC framework, the reporting clock turns on when the company decides the event is material, not when it first sees strange activity.
Official resources:
- Read the official guidance from SEC — Use this primary source to verify the official guidance.
- Read the original report from SEC — Use this primary source to review the complete report.
Table of Contents
- What the disclosure rules require
- How attackers seized the SEC account
- Market impact and criminal case
- What security teams should change now
What the disclosure rules require
According to the SEC in its press release on the 2023 cybersecurity rules, public companies must disclose material cybersecurity incidents and provide annual information on risk management, strategy and governance. The SEC adopted those final rules on July 26, 2023.
According to the SEC, material incidents must generally be reported on Form 8-K Item 1.05 within four business days after the company determines materiality. The filing must describe nature, scope, timing and impact or reasonably likely impact.
How attackers seized the SEC account
According to the SEC in its Chair statement on the X account compromise, shortly after 4:00 p.m. ET on Jan. 9, 2024 an unauthorized party gained control of the phone number for @SECGov.
The party then accessed the X account through an apparent SIM swap. According to the SEC, the takeover succeeded because multifactor authentication was disabled on @SECGov at the time. The agency says authentication had been disabled at staff request and was re-enabled only after the compromise.
Market impact and criminal case
According to the Department of Justice in its sentencing announcement for the SEC X hack, the account falsely posted in Chair Gensler's name that spot bitcoin ETFs were approved. That post briefly spiked bitcoin's price by over $1,000 before the SEC regained control and disavowed it. According to the FBI and DOJ, Alabama man Eric Council Jr. performed the SIM swap with a fake ID at a Huntsville carrier store.
He bought a new iPhone to receive reset codes, shared codes with conspirators, and received about $50,000 in bitcoin. According to the DOJ, Council pleaded guilty on Feb. 10, 2025 to conspiracy involving aggravated identity theft and access-device fraud. He was sentenced on May 16, 2025 to 14 months in prison plus $50,000 forfeiture.
What security teams should change now
According to the SEC, the four-day disclosure clock starts at the company's materiality determination, not discovery. That makes internal assessment speed critical, because investigation, legal review and business-impact analysis consume the same short window.
For prevention, the SEC now states that multifactor authentication is enabled on all agency social accounts offering it. Companies should apply the same control to corporate, executive and vendor-managed social accounts, especially those linked to market-moving announcements. Lock carrier ports now and require phishing-resistant multifactor authentication on every account that can publish or reset a public-facing channel.
- Lock carrier ports and require carrier PINs to block SIM swaps
- Require phishing-resistant multifactor authentication for social, email and carrier accounts
- Document who decides materiality, what evidence they need, and how fast Item 1.05 can be drafted
You Might Also Like
- Government Data Breach Security Review: Entry Point, Impact, and Lessons
- Cybersecurity — Volt Typhoon FAQ: Notifications, Rights, and Protection
- Cybersecurity — Salt Typhoon: What Organizations Should Fix Next