As COVID-19 Amplifies Cyberthreat, SEC Must Halt Collection of Retail Investor Data

ASA sends letter to House Financial Services Committee ahead of cyber hearing.



WASHINGTON – The American Securities Association (ASA) today sent a letter to House Financial Services Committee leadership urging the Committee to stop the Securities and Exchange Commission (SEC) from collecting the personally identifiable information of every American retail investor and storing it in a centralized Consolidated Audit Trail (CAT) database. ASA’s letter was sent ahead of today’s hearing examining how cybercriminals and fraudsters are exploiting the financial system during the COVID-19 pandemic.

“The ASA believes the largest cyberthreat currently facing the U.S. financial system is the pending collection of the personal and financial information of every American investor by the SEC’s CAT database,” ASA CEO Chris Iacovella wrote in the letter. “Despite the CAT becoming an obvious one-stop-shop for cybercriminals to steal the identities of Americans or manipulate our equity markets, the SEC has decided to march forward with the collection of retail investor PII.”

This comes at a time when the coronavirus pandemic has only exacerbated the cyber threat against government institutions and the financial industry. According to recent report from a leading cybersecurity firm, “from the beginning of February to the end of April 2020, attacks targeting the financial sector have grown by 238%.”

“The CAT will undoubtedly become a top target for hackers supported by the Chinese government, who have already been behind hacks on the Office of Personnel Management, National Aeronautics and Space Administration, National Security Agency, as well as countless other government and private entities in recent years,” Iacovella wrote. “Even the SEC was hacked in 2016—a breach it didn’t discover until August 2017.”

“We are calling on you to stop the SEC from continuing down this perilous path and to protect the private information of every American retail investor,” Iacovella concluded.

Last month, ASA filed a lawsuit against the SEC to protect American investor privacy. ASA also announced the launch of MyDataMyVote.com, and released a new digital ad campaign, to mobilize all American investors to help stop the collection of their most sensitive personal information.



###