Submission + - Should Hacked Companies Disclose Their Losses? (vice.com)
derekmead writes: By law, US companies don’t have to say a word about hacker attacks, regardless of how much it might’ve cost their bottom line. Comment, the group of Chinese hackers suspected in the recent-reported Coke breach, also broke into the computers of the world’s largest steel company, ArcelorMittal. ArcelorMittal doesn’t know exactly how much was stolen and didn’t think it was relevant to share news of the attack with its shareholders. Same goes for Lockheed Martin who fended off a “significant and tenacious” attack last May but failed to disclose the details to investors and the Securities Exchange Commission. Dupont got hit twice by Chinese hackers in 2009 and 2010 and didn’t say a word.
Former U.S. counterintelligence chief Joel Brenner recently said that over 2,000 companies, ISPs and research centers had been hit by Chinese hackers in the past decade and few of them told their shareholders about it. This is even after the SEC has made multiple requests for companies to come clean about cyber security breaches in their quarterly or annual earnings reports. Because the potential losses, do hacked companies have a responsibility to report security breaches to investors?
There’s no easy way for the SEC to force companies to comply with their requests. In some cases, the companies don’t even know they’ve been targeted by hackers until well after the attack. Sometimes, they give passing mention to an incident with boilerplate language about a security breach or the risk of data theft. They’re not likely to admit that hackers cost them billions, though. Unless rules change, it looks like if the SEC is going to get any serious hacking disclosure at all, they’ll need the help of a few companies leading the way on the disclosures.
Former U.S. counterintelligence chief Joel Brenner recently said that over 2,000 companies, ISPs and research centers had been hit by Chinese hackers in the past decade and few of them told their shareholders about it. This is even after the SEC has made multiple requests for companies to come clean about cyber security breaches in their quarterly or annual earnings reports. Because the potential losses, do hacked companies have a responsibility to report security breaches to investors?
There’s no easy way for the SEC to force companies to comply with their requests. In some cases, the companies don’t even know they’ve been targeted by hackers until well after the attack. Sometimes, they give passing mention to an incident with boilerplate language about a security breach or the risk of data theft. They’re not likely to admit that hackers cost them billions, though. Unless rules change, it looks like if the SEC is going to get any serious hacking disclosure at all, they’ll need the help of a few companies leading the way on the disclosures.
