SEC Sanctions Eight Broker Dealers/RIAs for Deficient Cybersecurity Protection 

 According to the Securities and Exchange Commission on August 30, the regulator has sanctioned eight broker-dealers/registered investment advisers for a lack of cybersecurity policies and procedures that reportedly caused email account takeovers exposing the personal information of thousands of customers. 

The eight firms, which have agreed to settle the charges, are: Cetera Advisor Networks LLC, Cetera Investment Services LLC, Cetera Financial Specialists LLC, Cetera Advisors LLC, and Cetera Investment Advisers LLC (collectively, the Cetera Entities); Cambridge Investment Research Inc. and Cambridge Investment Research Advisors Inc. (collectively, Cambridge); and KMS Financial Services Inc. (KMS).  

Between November 2017 and June 2020, the cloud-based email accounts of more than 60 Cetera personnel were reportedly taken over by unauthorized third parties, exposing personally identifying information of at least 4,388 customers and clients. None of the accounts were protected with Cetera entities’ policies, according to the SEC. 

Further, the SEC claims that Cetera Advisors and Cetera Investment Advisers sent breach notifications to its clients that included misleading language suggesting that the notifications were issued “much sooner” than they actually were after discovering the incidents. 

Between January 2018 and July 2021, the cloud-based email accounts of 121 Cambridge representatives were reportedly taken over, resulting in the exposure of at least 2,177 customers and clients, according to the SEC’s order. 

The SEC claims that although Cambridge discovered the first email account takeover in January 2018, it failed to adopt and implement firm-wide enhanced security measures for cloud-based email accounts until 2021, resulting in the exposure and potential exposure of additional client records and information. 

Between September 2018 and December 2019, the email accounts of 15 KMS financial advisers or their assistants were taken over, resulting in the exposure of approximately 4,900 customers and clients. 

The SEC claims that KMS failed to adopt written policies and procedures requiring additional firm-wide security measures until May 2020 and did not fully implement those additional security measures firm-wide until August 2020, allegedly placing additional customer and client records and information at risk. 

Each firm reportedly agreed to cease and desist from future violations, to be censured, and to pay a penalty, without admitting or denying the charges. The Cetera entities will pay a $300,000 penalty, Cambridge will pay $250,000, and KMS will pay $200,000, according to the SEC. 

Free Consultation with a Securities Attorney

This information is all publicly available and provided to you by The White Law Group.  

For more information on the firm’s investigations please see: 

Cambridge Investment Research Inc. Lawsuits – Broker Fraud, Investigation and Regulatory… 

3 Cetera Firms to pay $1 Million for Supervisory Issues

Lawsuit Filed Against Cetera Advisors, LLC over High Risk Energy Investments 

 If you are concerned about your investments and would like a free consultation with a securities attorney, please call The White Law Group at 888-637-5510. 

 The White Law Group is a national securities arbitration, securities fraud, and investor protection law firm with offices in Chicago, Illinois. 

For more information on The White Law Group, visit www.whitesecuritieslaw.com.