It would take "substantial" time to determine the full damage of the 2016 cybersecurity breach to the U.S. Securities and Exchange Commission, Chairman Jay Clayton said in testimony to the Senate Banking Committee Tuesday, according to The Hill.
The hack to the SEC public-company filing system, EDGAR, which was disclosed Sept. 20, created an opportunity for cyberattackers to profit through illicit trading. The incident was initially detected in 2016.
In his testimony, Mr. Clayton said he acted as quickly as he could to disclose the EDGAR breach, adding he did not learn about it until an internal review of the agency's cybersecurity last month. While much of the information in the electronic filing system is publicly accessible, EDGAR also contains private financial records.
When asked why it took him so long to publicly reveal the breach, he said he waited until he learned "enough to understand that the 2016 intrusion provided access to nonpublic EDGAR test filings," which may have led to insider trading, reports The Hill.
Mr. Clayton did not reveal who was responsible for the attack or which companies were targeted.
"Our review and investigation of these matters, however, as well as the extent and impact of the intrusion and related illicit activity, is ongoing and may take substantial time to complete," Mr. Clayton said.
Several committee members pressed Mr. Clayton to confirm whether the SEC would investigate the June Equifax hack that sparked a number of executive resignations, but he repeatedly declined comment. "It would be inappropriate for me to discuss that," he said.
More articles on cybersecurity:
Hospital leaders should be weary of accidental insider mistakes, better prepare employees
6 Trump advisers used personal email accounts: 6 things to know
Hack on Deloitte goes undiscovered for months, potentially impacts 5M emails