What is an SEC enforcement action in cybersecurity? Charges, orders and penalties, defined

An SEC enforcement action in cybersecurity is a civil action in federal court, or an administrative proceeding, that the US Securities and Exchange Commission (SEC) brings over cybersecurity conduct, such as misleading disclosures about cybersecurity incidents and risks. Many cases settle without trial, and settled cyber cases have taken the form of cease-and-desist orders with civil penalties.

How a case is brought

The SEC's Division of Enforcement investigates privately, then presents findings to the Commission. In court the SEC can seek injunctions, civil monetary penalties and disgorgement. Administrative sanctions include cease-and-desist orders, censures, industry bars, penalties and disgorgement. The SEC's own authority is civil; the Division works with criminal authorities when a case warrants it.

Cases on the record

An early breach-disclosure case involved the company formerly known as Yahoo. On 24 April 2018 the SEC announced that the company had agreed to pay a $35 million penalty to settle charges that it misled investors by failing to disclose a large data breach. The company neither admitted nor denied the findings in the cease-and-desist order.

On 22 October 2024 the SEC charged four companies, Unisys, Avaya, Check Point Software Technologies and Mimecast, over materially misleading disclosures about cybersecurity risks and intrusions. The investigation grew out of the compromise of SolarWinds' Orion software. Penalties ran from $990,000 to $4 million, and each company agreed to cease and desist without admitting or denying the findings.

On 20 February 2025 the SEC created a Cyber and Emerging Technologies Unit. Its listed priorities include regulated entities' compliance with cybersecurity rules and public issuer fraudulent disclosure relating to cybersecurity.

Why it matters to a CISO

The 2024 orders turned on what each company learned about an intrusion and how its later disclosures described it. That makes internal escalation records, the annual risk language and any Form 8-K Item 1.05 filing the evidence an investigation tests against each other.

What it is not

It is not a Federal Trade Commission data security case, which this site follows on the enforcement tracker, and it is not a private suit by investors or consumers. Settled SEC orders work much like a consent order.

Where it appears on cisonews.net

SEC disclosure cases connect to the Item 1.05 filings tracker and the Item 1.05 guide. Related terms: business email compromise.