The U.S. Securities and Exchange Commission (SEC) issued a statement addressing the breach of its X.com account, which resulted in a fraudulent announcement falsely claiming the approval of a spot bitcoin exchange-traded fund (ETF) in the SEC’s name.
According to the available information, the unauthorized party gained access to the @SECGov X.com account around 4:00 pm ET on Tuesday, January 9, 2024, by taking control of the associated phone number. At 4:11 pm ET, the unauthorized party posted a false announcement about the Commission’s approval of spot bitcoin ETFs, followed by a second post saying “$BTC” about two minutes later. Although the second post was later deleted, the first remained. The unauthorized party also liked two posts from non-SEC accounts using the @SECGov account. As of now, there’s no evidence that the unauthorized access extended to SEC systems, data, devices, or other social media accounts.
https://www.sec.gov/news/statement/gensler-x-account
Upon discovering the incident, the Office of Public Affairs promptly posted on the official @garygensler X.com account at 4:26 pm ET, informing the public of the compromise, the unauthorized post, and clarifying that the SEC had not approved spot bitcoin ETFs. Staff took corrective actions, including deleting the first unauthorized post, un-liking the two posts, and, at 4:42 pm ET, posting on @SECGov to confirm the account’s compromise. Additionally, the SEC sought assistance from X.com to terminate the unauthorized access, and it appears the access was terminated between 4:40 pm ET and 5:30 pm ET.
Emphasizing its commitment to cybersecurity, the SEC is assessing the incident’s impact on the agency, investors, and the marketplace. Recognizing concerns about the security of its social media accounts, the SEC staff is exploring potential remedial measures. Collaboration with law enforcement entities, such as the SEC’s Office of Inspector General, the FBI, and the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency, is ongoing.
The SEC assures that updates on the incident will be provided as necessary. Notably, the Commission emphasizes that its official actions are communicated through its website (http://www.sec.gov), not through social media channels, with social media posts only amplifying announcements made on the website.
