SEC Accuses Transfer Agent Equiniti Trust Co. of Failing to Protect Client Money from Cyberattacks

Washington, DC–(Newsfile Corp. – August 20, 2024) – The Securities and Exchange Commission announced today that it has settled charges against New York-based registered transfer agent Equiniti Trust Company LLC, formerly known as American Stock Transfer & Trust Company LLC, for failing to ensure that client securities and funds were protected from theft or misuse. These failures led to the loss of more than $6.6 million in client funds as a result of two separate cyber breaches in 2022 and 2023. American Stock Transfer was able to recover approximately $2.6 million of the losses and fully reimbursed clients for their losses. To settle the SEC’s charges, Equiniti agreed to pay an $850,000 civil penalty.

According to the SEC’s brief, in September 2022, an unknown threat actor hijacked a pre-existing email chain between what was then American Stock Transfer and a U.S.-based public issuer. Posing as an employee of the issuer, the threat actor then instructed American Stock Transfer to issue millions of new shares of the issuer’s stock, liquidate those shares, and send the proceeds to an offshore bank. The SEC’s brief finds that American Stock Transfer followed these instructions and transferred approximately $4.78 million to bank accounts in Hong Kong, of which American Stock Transfer was able to recover approximately $1 million.