US charges hackers, traders with stealing SEC filings

US authorities on Tuesday charged a suspected Ukrainian computer hacker and several traders with scheming to trade on market-moving corporate earnings news stolen from a US Securities and Exchange Commission database.

The charges against 10 defendants, including two charged criminally, relate to a suspected 2016 intrusion into Edgar, the SEC’s corporate filing system used by public companies and money managers.

Authorities said the scheme resulted in USD 4.14 million of illegal trading profit and cheated ordinary investors.

SEC Chairman Jay Clayton said the case illustrated the “significant” threats that cybercrime poses to US markets, including from outside US borders, and that his agency is not immune despite efforts to bolster its cyber defences.

Authorities said Oleksandr Ieremenko, 26, and Artem Radchenko, 27, both of Kiev, used a Lithuanian server to hack into Edgar and obtain thousands of “test filings,” including 157 earnings announcements and shared their findings with traders.

The Department of Justice said conspirators sent fake emails to SEC employees that appeared to be from other employees, enabling Ieremenko and Radchenko to steal filings through phishing attacks and by installing malware on SEC computers.

Ieremenko and Radchenko were charged with computer fraud, wire fraud and conspiracy in a 16-count indictment filed with the federal court in Newark, New Jersey.

The SEC filed related civil charges accusing six individuals and two companies in the United States, Russia and Ukraine of reaping the USD 4.14 million of gains from May to October 2016, with some profits kicked back to Ieremenko.

Two Los Angeles residents, Sungjin Cho and David Kwon, are among the defendants in the SEC case, which seeks to impose fines and recoup illegal gains. Ieremenko was also charged.

None of the defendants could immediately be reached for comment, and their lawyers could not immediately be identified.

Companies sometimes submit test filings to ensure their actual SEC filings will be processed correctly.

Test filings are not typically supposed to contain sensitive nonpublic data, but the SEC said some do.

Ieremenko has been at large since being criminally charged in 2015 over the theft of more than 150,000 corporate press releases from Berkshire Hathaway Inc’s Business Wire, West Corp’s Marketwired and Cision Ltd’s CISN.N PR Newswire.

More than 40 defendants were criminally or civilly charged in that scheme, which US authorities said generated more than USD 100 million of trading profit over 5-1/2 years.

The SEC said Ieremenko turned his attention to Edgar after the newswire scheme ended.

The cases are US v. Radchenko, US District Court, District of New Jersey; and SEC v Ieremenko et al in the same court, No. 19-00505.