Connect with us

Hi, what are you looking for?


Incident Response

NYSE Operator Intercontinental Exchange Gets $10M SEC Fine Over 2021 Hack

Intercontinental Exchange, the company that operates NYSE and other exchanges, has agreed to pay a $10 million fine related to a 2021 hack.


The US Securities and Exchange Commission (SEC) announced on Wednesday that Intercontinental Exchange (ICE) has agreed to pay a $10 million fine to settle charges related to a hacker attack that occurred in 2021.

ICE, described as a foundational part of the global financial system, operates the New York Stock Exchange (NYSE) and other exchanges. The company learned from a third-party in April 2021 that one of its VPNs was hacked through the exploitation of a zero-day vulnerability. 

The hackers planted malicious code on the VPN device, which had been used for remote access to the company’s corporate network. 

While the targeted VPN has not been named, one zero-day that made headlines in April 2021 was CVE-2021-22893, which at the time was exploited against Pulse Secure customers. 

ICE’s investigation into the incident revealed days later that the intrusion was limited to the targeted VPN device. 

However, the SEC was displeased that ICE failed to immediately notify legal and compliance officials at NYSE and eight other subsidiaries of the incident, which prevented the subsidiaries from properly assessing the hack to fulfill their independent disclosure obligations. 

The SEC said it should have immediately been notified and provided with an update within 24 hours, unless the company had immediately concluded that the cyberattack had no or minimal impact on operations. Instead, it took ICE several days to inform subsidiaries.

The SEC said ICE has agreed to pay a $10 million fine without admitting or denying the agency’s findings.

Advertisement. Scroll to continue reading.

An ICE spokesperson said in a statement sent to SecurityWeek, “This settlement involves an unsuccessful attempt to access our network more than three years ago. The failed incursion had zero impact on market operations. At issue was the timeframe for reporting this type of event under Regulation SCI.”

Two SEC commissioners issued a statement on the decision, calling it a “disproportionately large penalty”.

*Updated with statement from ICE and the SEC commissioners’ comments

Related: SEC Investigating Progress Software Over MOVEit Hack

Related: SEC Says Companies Must Disclose Cybersecurity Incidents Within 4 Days

Related: FCC Fines Wireless Carriers for Sharing User Locations Without Consent

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.


Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.


The AI Risk Summit brings together security and risk management executives, AI researchers, policy makers, software developers and influential business and government stakeholders.


People on the Move

Retired U.S. Army General and former NSA Director Paul M. Nakasone has joined the Board of Directors at OpenAI.

Jill Passalacqua has been appointed Chief Legal Officer at autonomous security solutions provider

Cisco has appointed Sean Duca as CISO and Practice Leader for the APJC region.

More People On The Move

Expert Insights