US Senators Demand SEC Report on Recent X Breach, Set Deadline for Response

Two United States senators, J.D. Vance and Thom Tillis, have called upon the Securities and Exchange Commission (SEC) to provide a detailed report to Congress regarding the recent breach of its X (formerly Twitter) account. This incident, which occurred on Jan. 9, 2024, involved the unauthorized use of the agency’s social media account to disseminate false information about the approval of Bitcoin exchange-traded funds (ETFs) in the United States.

The SEC X Account Breach

The breach, which led to the posting of a false tweet from the X account, suggested that spot Bitcoin ETFs had been approved in the U.S., causing a brief but intense flurry of excitement within the cryptocurrency community. However, the excitement was short-lived as SEC Chair Gary Gensler quickly clarified that the account had been compromised and the tweet was unauthorized.

Senators Raise Concerns

Senators Vance and Tillis, in their letter to Gensler, expressed “serious concerns” about the regulator’s internal cybersecurity procedures, stating that the incident was “antithetical to the Commission’s tripartite mission to protect investors, maintain fair, orderly, and efficient markets, and facilitate capital formation.” The senators emphasized the need for clarity on the incident, especially in light of the finalized rulemaking regarding cybersecurity disclosures.

The Demand for a Report From the SEC

The senators have requested that the SEC provide Congress with a report about the incident, in line with the mandate that requires all businesses to disclose all impacts to the business within four days of a cybersecurity incident. They set a deadline of Jan. 23 for the the agency to respond.

Market Reaction and Official Statements

The market’s reaction to the false tweet was unpredictable, with many pointing out the agency’s apparent lack of preparedness against cyberattacks and online threats. An internal investigation by X revealed that the regulator’s account was not using two-factor authentication at the time of the breach. The compromise was attributed to an unidentified individual gaining control over a phone number associated with the regulator’s account through a third party.

Government Officials Echo Concerns

Several top-ranking government officials, including Senators Cynthia Lummis and Bill Hagerty, as well as Representative Ann Wagner, echoed the concerns raised by their fellow members of Congress. Senator Hagerty demanded full disclosure about the incident, while Senator Lummis highlighted the risks associated with fraudulent announcements that can manipulate markets.

Implications and Future Actions

This incident underscores the growing concerns around cybersecurity in government agencies and the potential market impacts of such breaches. The regulator, known for demanding accountability from public companies in similar situations, now faces scrutiny over its cybersecurity protocols and response mechanisms. The forthcoming report to Congress is expected to shed light on the specifics of the breach and the steps the regulator will take to prevent such incidents in the future.