Gary Gensler answers lawmakers about X breach and fake Bitcoin ETF approval
The SEC's social media account was illegally accessed in January.
On Jan. 9, an unknown actor performed a SIM swap attack on the SEC’s X account then published a false message stating that the SEC had approved various spot Bitcoin ETFs. Though the SEC ultimately approved those funds on Jan. 10, the earliest message was inauthentic.
Gensler said to lawmakers in a letter:
“I assure you that the SEC takes its cybersecurity obligations seriously. I understand that the SEC’s Office of Legislative and Intergovernmental Affairs arranged a briefing on January 17 for your staff concerning the X incident and addressing the questions raised in your letter.”
Gensler’s letter addresses House members Patrick McHenry, Bill Huizenga, French Hill, and Ann Wagner. In addition to commenting individually, those House members wrote a letter on Jan. 10 asking the SEC to hold itself to the security disclosure standards it imposes on companies.
The House members asked the SEC to respond to their request by Jan. 17 — a deadline that the SEC seemingly satisfied, given that Gensler reported a briefing on that date.
In a separate Jan. 11 letter, Senators Ron Wyden and Cynthia Lummis asked the SEC to begin an investigation into multi-factor authentication and phishing-resistant hardware tokens (or security keys) and close any security gaps. Though an update on that matter was due today, Feb. 12, the latest letter does not address the senators and no other response has been reported.
Gensler says the investigation is still ongoing
In the remainder of his letter, Gensler described a previously known attack timeline and provided an update on investigations. He said that law enforcement is currently investigating how the attacker had the carrier service change the SIM associated with the SEC’s X account, and how the attacker identified the phone number associated with the SEC’s account.
Unlike those earlier statements, Gensler’s letter to lawmakers is not public and largely went unnoticed until now. The letter is dated Feb. 6 and was publicized by Politico on Feb. 8. Various sources circulated and reported on the letter more broadly today.