Law firm data breach, is the fed overreaching?

Every now and then, something really important happens that somehow seems to slide under the radar without much visibility. Those of us in the cybersecurity business pray daily for these occasions. Occasionally however, these proceedings have significance and influence far beyond the initial matter.

On January 12, 2023, the SEC Filed a Subpoena Enforcement Action Against Law Firm Covington & Burling LLP directing them to identify the names of clients who were associated with the November 2020 Hafnium cyberattack on Covington. The SEC subpoena states that the information is requested:

1. To “assist it in identifying any suspicious trading by the threat actors or others in those clients' securities, and whether such trading was illegal based on material non-public information that the threat actors viewed or exfiltrated as part of the cyberattack” and,
2. Provides that the information will help determine “whether the impacted clients made all required disclosures to the investing public about any material cybersecurity events in connection with the cyberattack.”

I acknowledge that the issue of material nonpublic information (MNPI) related to cybersecurity is important since it was front page news when the SEC charged an Equifax insider for improperly trading company stock based on prior knowledge of the 2017 Equifax data breach. The SEC’s enforcement division allegedly took similar actions following the Solar Winds cyber-attack in 2021 to determine whether any victimized Solar Winds customers subject to U.S. securities laws properly disclosed to investors whether or not there was any suspicious trading related to the incident and whether private data was compromised.

While these may be appropriate actions for the SEC to take, it seems to highlight the whole issue of secondary victims of data breaches. Additionally, it raises the question of whether other companies might get an SEC subpoena for information that could be used against their customers who may have been victimized by a cyber-attack. There are clear ethical boundaries and client expectations regarding attorney-client privilege, client confidentiality, and doctor-patient privilege, but perhaps not-so-clear boundaries for those companies where privilege issues aren’t codified in statute or prior precedent.

Another concern I have is that, while not specifically stated, once the SEC has the names of customers, they, or another federal agency such as the FTC, could begin additional investigations to determine whether or not those customers had ‘appropriate’ security controls in place, possibly completely unrelated to the initial incident that prompted the investigation. That should scare the bejesus out of everyone including CEOs, GCs, CIOs, and CISOs.

Finally, I am not lawyer and these are just my musings as an interested layman. Happy to hear your thoughts.