SEC Charges Firm for Misleading Investors About Cyber Breach

The SEC continued a recent spate of cyber enforcement actions with the announcement that Pearson, a London-based public company that provides educational publishing and other services to schools and universities, had agreed to pay $1 million to settle charges that it misled investors about a 2018 cyber intrusion involving the theft of millions of student records and had inadequate disclosure controls and procedures. The SEC’s order found that Pearson made misleading statements and omissions about the 2018 data breach involving the theft of student data and administrator log-in credentials, referred to a data privacy incident as a hypothetical risk, when, in fact, the 2018 cyber intrusion had already occurred. And in a July 2019 media statement, the company stated that the breach may include dates of births and email addresses, when, in fact, it knew that such records were stolen, and that Pearson had “strict protections” in place, when, in fact, it failed to patch the critical vulnerability for six months after it was notified. The media statement also omitted that millions of rows of student data and usernames and hashed passwords were stolen. The order also finds that Pearson's disclosure controls and procedures were not designed to ensure that those responsible for making disclosure determinations were informed of certain information about the circumstances surrounding the breach. “As public companies face the growing threat of cyber intrusions, they must provide accurate information to investors about material cyber incidents,” said Kristina Littman, Chief of the SEC Enforcement Division's Cyber Unit. Without admitting or denying the SEC’s findings, Pearson agreed to cease and desist from committing violations of these provisions and to pay a $1 million civil penalty.