Washington, D.C. – Phillip Capital Inc. (PCI), a registered futures commission merchant, has been slapped with a $1.5 million penalty by the Commodity Futures Trading Commission (CFTC) for a significant cybersecurity lapse that resulted in the theft of $1 million in customer funds. The CFTC order, issued and settled on September 12, 2019, details how cybercriminals successfully breached PCI’s email systems, gaining access to sensitive customer data and illicitly withdrawing the funds.
The investigation revealed that PCI not only failed to protect its systems from the cyberattack but also neglected to promptly inform affected customers about the data breach. Further, the CFTC found PCI lacked adequate supervision of its employees regarding crucial cybersecurity protocols, a written information systems security program, and proper customer disbursement procedures.
The monetary sanctions levied against PCI total $1.5 million, comprised of a $500,000 civil monetary penalty and $1 million in restitution. Importantly, PCI will receive credit for the $1 million restitution as the company proactively reimbursed customers after discovering the fraudulent activity. The settlement also mandates PCI submit regular reports to the CFTC detailing its efforts to remediate the security vulnerabilities and strengthen its cybersecurity infrastructure.
“Cybercrime is a real and growing threat in our markets,” stated James McDonald, CFTC Director of Enforcement. “While it may not be possible to eliminate all cyber threats, CFTC registrants must have adequate procedures in place — and follow those procedures — to protect their customers and their accounts from potential harm.”
Ilana Waxman, Alison B. Wilson, and Rick Glaser of the CFTC’s Division of Enforcement led the investigation, with assistance from the Division of Swap Dealer and Intermediary Oversight. The case underscores the increasing importance of robust cybersecurity measures within financial institutions to safeguard customer assets and maintain market integrity.
Source: CFTC.gov
Related Federal Cases
- Letitia James, Trump Administration Data Seizure Attempt, New York … · Washington
- 23andMe, Data Auction Without Consent, New York NY, 2023 · New Mexico
- 23andMe, Selling Genetic Data Without Consent, New York, 2023 · New Mexico
- Wayne Bridgeforth, Package Theft, DC 2023 · Washington
- Martin Tyronne Woods, Tax Identity Theft, AL 2024 · Alabama
MORE FEDERAL CRIME NEWS
US NewsUS NewsUS NewsUS News