The United States Securities and Exchange Commission (SEC) has announced that the Intercontinental Exchange (ICE) will incur a penalty of $10 million for its failure to promptly report a cyber intrusion to authorities. The breach, uncovered in April 2021, involved the insertion of malicious code into a virtual private network (VPN) device, granting unauthorized access to ICE’s corporate network. Despite quickly identifying the threat, ICE neglected to notify legal and compliance officials at its subsidiaries, including the New York Stock Exchange (NYSE), for several days.

Under the agency’s Regulation Systems Compliance and Integrity (Regulation SCI), companies are obligated to immediately notify the SEC of any significant cybersecurity incident. Gurbir Grewal, Director of Enforcement at the SEC, emphasized the critical nature of prompt reporting in cybersecurity incidents, particularly within vital market intermediaries, where time is of the essence.

ICE operates the world's largest network of exchanges and clearing houses, encompassing subsidiaries such as the NYSE, ICE Futures U.S. and Europe, as well as various clearing houses and data providers. The SEC's enforcement action impacted several ICE subsidiaries, including Archipelago Trading Services Inc, NYSE American LLC, and ICE Clear Credit LLC, among others. Additionally, the Securities Industry Automation Corporation agreed to a cease-and-desist order in addition to the monetary penalty.

In response to the imposed fines, SEC Commissioners Hester Peirce and Mark Uyeda issued a statement characterizing the penalty as an "overreaction" to what they deemed a "minimal incident." They expressed concern that the substantial penalty for a delayed reporting of an incident ultimately deemed insignificant by ICE subsidiaries suggests a prioritization of generating large penalties over addressing technological vulnerabilities and enhancing market integrity. This critique aligns with previous criticisms leveled by the commissioners regarding the SEC's handling of matters related to cryptocurrency companies, indicating a broader concern with the agency's penalty regime and enforcement approach.