尽管 IG 发出警告，SEC 网络安全漏洞仍凸显缺陷

就在重大网络安全漏洞发生前两周，美国证券交易委员会 (SEC) 收到监察长办公室 (OIG) 的网络安全防御严重失误的通知。监察办的报告强调需要加强安全协议，包括漏洞管理和风险评估，但这些建议并未得到实施。因此，1 月 9 日，一个未经授权的实体入侵了 SEC 的 X 账户，导致有关比特币 ETF 批准的虚假公告以及约 9000 万美元的市场清算。

SEC Cybersecurity Breach Exposes Deficiencies Despite Warnings

尽管发出警告，美国证券交易委员会网络安全漏洞还是暴露了缺陷

Two weeks before a major cybersecurity breach compromised the U.S. Securities and Exchange Commission (SEC), the Office of Inspector General (OIG) had raised red flags about critical lapses in the agency's cybersecurity defenses. A scathing report issued by Cotton & Company Assurance and Advisor laid bare the SEC's systemic failure to maintain robust security measures for its digital assets.

在美国证券交易委员会 (SEC) 遭遇重大网络安全漏洞之前两周，监察长办公室 (OIG) 就该机构网络安全防御中的严重失误发出了危险信号。 Cotton & Company Assurance and Advisor 发布的一份措辞严厉的报告揭露了 SEC 在为其数字资产维持强有力的安全措施方面的系统性失败。

The report highlighted urgent deficiencies in vulnerability management and risk assessment, emphasizing the need for immediate remediation. The OIG strongly advised the SEC to overhaul its information security controls, embracing risk management, enhancing security training, and implementing continuous diagnostics.

该报告强调了漏洞管理和风险评估方面的紧急缺陷，并强调需要立即进行补救。 OIG 强烈建议 SEC 彻底改革其信息安全控制措施，实行风险管理，加强安全培训并实施持续诊断。

Despite these urgent recommendations, the SEC remained complacent, leaving itself vulnerable to exploitation. On January 9, an unauthorized entity breached the SEC's official X account, disseminating a false announcement regarding the approval of a Bitcoin ETF.

尽管有这些紧急建议，美国证券交易委员会仍然沾沾自喜，很容易受到剥削。 1 月 9 日，一个未经授权的实体侵入了 SEC 的官方 X 账户，传播了有关比特币 ETF 获得批准的虚假公告。

The breach sent shockwaves through the financial markets, with reports indicating that the false information triggered market liquidations exceeding $90 million. The attackers employed a SIM-swapping technique, gaining control of the SEC's phone number to bypass two-factor authentication measures that the agency had inexplicably failed to implement for the targeted account.

此次泄露事件给金融市场带来了冲击，有报道称，虚假信息引发了超过 9000 万美元的市场清算。攻击者采用 SIM 交换技术，控制了 SEC 的电话号码，以绕过该机构莫名其妙地未能为目标帐户实施的双因素身份验证措施。

As the SEC scrambled to contain the damage, it admitted that the breach had been confined to social media and had not compromised internal systems or data. The agency claimed that the attackers had exploited a vulnerability within the telecom carrier, not the SEC's own digital infrastructure.

当美国证券交易委员会忙于遏制损害时，它承认此次违规行为仅限于社交媒体，并未损害内部系统或数据。该机构声称，攻击者利用了电信运营商内部的漏洞，而不是 SEC 自己的数字基础设施。

Congressional lawmakers have responded with shock and outrage, demanding accountability from SEC leadership. "This breach is a clear indication of the SEC's incompetence and gross negligence," declared Senator Elizabeth Warren. "The agency was warned of its vulnerabilities and ignored the warnings, putting millions of Americans at risk."

国会议员对此表示震惊和愤怒，要求 SEC 领导层承担责任。参议员伊丽莎白·沃伦 (Elizabeth Warren) 表示：“这一违规行为清楚地表明了 SEC 的无能和严重疏忽。” “该机构被警告其漏洞，但却忽视了这些警告，使数百万美国人面临风险。”

Representative Maxine Waters, the ranking member of the House Financial Services Committee, echoed Warren's concerns, stating, "The SEC must be held fully accountable for this catastrophic failure. The agency's failure to act on the OIG's recommendations is inexcusable and has endangered the integrity of our financial markets."

众议院金融服务委员会资深成员众议员玛克辛·沃特斯（Maxine Waters）回应了沃伦的担忧，她表示：“美国证券交易委员会必须对这一灾难性失败承担全部责任。该机构未能按照监察长办公室的建议采取行动是不可原谅的，并且已经危及了金融机构的诚信。”我们的金融市场。”

The breach has cast a dark shadow over the SEC's credibility and raised serious questions about its ability to protect sensitive information and safeguard investors. The agency now faces an uphill battle to regain the trust of the public it is charged with regulating.

此次违规事件给美国证券交易委员会的信誉蒙上了阴影，并对其保护敏感信息和保护投资者的能力提出了严重质疑。该机构现在面临着一场艰苦的战斗，以重新获得其负责监管的公众的信任。