(Photo by Jonathan Raa/NurPhoto via Getty Images)
The Securities and Exchange Commission has confirmed that a SIM swap led a hacker to take over the @SECGov Twitter account earlier this month.
In a Monday statement, the SEC said the “unauthorized party” gained access to the account by first targeting the financial regulator's telecommunications carrier. Somehow, the hacker learned the cell number connected to @SECGov. The attacker then tricked the carrier into transferring the cell number to their own device, allowing them to complete a password reset for account on Twitter, now X.
"Access to the phone number occurred via the telecom carrier, not via SEC systems," the statement added. "SEC staff have not identified any evidence that the unauthorized party gained access to SEC systems, data, devices, or other social media accounts."
Still, the financial regulator confirmed that the @SECGov account had not activated two-factor authentication, a widely recommended security safeguard that can prevent account hijackings.
"While multi-factor authentication [MFA] had previously been enabled on the @SECGov X account, it was disabled by X Support, at the staff’s request, in July 2023 due to issues accessing the account,” the SEC said. “Once access was reestablished, MFA remained disabled until staff reenabled it after the account was compromised on January 9. MFA currently is enabled for all SEC social media accounts that offer it.”
The SEC issued the update weeks after Twitter itself blamed the embarrassing incident on a SIM swap. By hijacking the account, the hacker was able to exploit the @SECGov profile to prematurely tweet that the financial regulator had cleared Bitcoin ETFs for national securities exchanges. The phony tweet briefly roiled markets, sending the value of Bitcoin soaring before it plummeted after the SEC warned the public that its Twitter account had been compromised.
Although the SEC has been investigating the incident, the regulator is still trying to uncover who was behind the hijacking, along with other details like "how the unauthorized party got the carrier to change the SIM for the account and how the party knew which phone number was associated with the account,” the SEC said.
The investigation occurs as some lawmakers have blasted the SEC for neglecting to follow its own rules and guidance on cybersecurity. “This failure is unacceptable, and it is disturbing that your agency could not even meet the standard you require of private industry,” Republican lawmakers told the SEC in a letter earlier this month.