SEC orders system-wide audit after data breach

The Securities and Exchange Commission (SEC) is conducting a system-wide security audit and tightening safeguards across its digital platforms following a data breach that may have exposed personal information.

In a statement on Monday, the SEC said it is investigating the 6 November incident to determine the source and extent of the possible data exposure while strengthening security controls across its databases.

“The SEC assures the public that all internal database infrastructure and system integrity remain intact,” the Commission said.

Initial findings showed that no company records were compromised, no passwords were leaked, and no data was modified or altered.

However, the regulator acknowledged that individual profile information may have been exposed. It is still verifying the origin, scope, and validity of the affected records.

To address the breach, the SEC has launched comprehensive security scans, digital forensic examinations, and system log analyses to identify potential unauthorized access across its digital infrastructure.

It has also reinforced access controls, updated authentication credentials, and introduced additional monitoring rules to prevent similar incidents.

The Commission said these measures are intended to protect corporate data assets and detect potential vulnerabilities before they can be exploited.

The SEC formally notified the National Privacy Commission on 9 November in compliance with mandatory reporting requirements.

Meanwhile, the regulator has intensified monitoring of suspicious account activity and introduced additional verification checks for account-related requests and security updates.

As the investigation continues, the SEC urged users to change passwords shared across online accounts, activate multi-factor authentication, and remain alert to suspicious emails, calls, and messages requesting personal information.

“The SEC is fully dedicated to upholding the confidentiality, privacy, and integrity of user information and all other records entrusted to the Commission,” it said.

The regulator has yet to establish the full extent of the possible exposure as its investigation and security assessment continue.