Insurance for natural disasters is failing homeowners − I don’t have the answers, but I do know the right questions to ask
Joe Biden’s record on science and tech: Investments and regulation for vaccines, broadband, microchips and AI
Meta shift from fact-checking to crowdsourcing spotlights competing approaches in fight against misinformation and hate speech
Hope and dread as Israelis and Palestinians await a Gaza truce that may not end their suffering
In eyeing Greenland, Trump is echoing long-held American designs on the Arctic expanse
When Sylvester Stallone’s French dubbing artist died, AI recreated his voice. His daughter is not happy
'It's not good enough.' Sidney Crosby, Evgeni Malkin and the Penguins are floundering at midseason
Jayden Daniels accomplishes a feat last done by Slinging Sammy Baugh in 1937
Wildfires latest: A final round of dangerous fire weather and dry conditions is in the forecast
By Douglas Gillison
(Reuters) - Wall Street's top regulator was the victim of "SIM swapping," a technique internet fraudsters use to seize control of telephone lines, when its account on the social media platform X, formerly known as Twitter, was hacked earlier this month, the U.S. Securities and Exchange Commission said on Monday.
The SEC also said that, six months prior to the attack, staff had removed an added layer of protection, known as multi-factor authentication, and did not restore it until after the Jan. 9 attack.
As anticipation mounted for the agency's approval of exchange-traded products tracking bitcoin, an unidentified person or persons gained access to the account, posting the false announcement that approval had already been granted, causing a momentary jump in the cryptocurrency's price.
In a split vote, the commission granted approval the following day.
SIM swapping is a technique in which attackers gain control of a telephone number by having it reassigned to a new device.
"Once in control of the phone number, the unauthorized party reset the password for the @SECGov account," an SEC spokesperson said in a statement.
Law enforcement agencies are working to learn how the hackers prevailed on the SEC's mobile carrier to make the switch, the SEC said, without identifying the carrier.
Lawmakers have demanded explanations as to how the SEC could have left itself exposed to such an attack, when it holds publicly traded companies to tough cybersecurity requirements.
Monday's statement also said that due to difficulties accessing the account, SEC staff had asked X Support in June of 2023 to disable multi-factor authentication, which can offer added protection against unauthorized access.
"MFA currently is enabled for all SEC social media accounts that offer it," the statement said.
A representative for X did not immediately respond to a request for comment.
The incident is under investigation by agencies including SEC's Office of Inspector General and its Division of Enforcement; the Commodity Futures Trading Commission, which regulates bitcoin futures; Federal Bureau of Investigation; Department of Justice; and Cybersecurity and Infrastructure Security Agency, the statement said.
(Reporting by Douglas Gillison; Editing by Richard Chang)
