USA'S SEC has sued a transfer agent for "failing to protect clients' funds against cyber intrusions".
The company says "Our dedicated team processes, guides, and seamlessly executes critical stock transfer agent services...With complete public and private transfer and registry services, we deliver unique insights, technology-based solutions, and informed, strategic recommendations that yield an extraordinary shareholder experience. "
As a part of those somewhat vaguely described services, EQ received money on behalf of its corporate clients and it holds that money in a clients' account.
in September 2022, an unknown person hijacked an existing email chain between what was then American Stock Transfer and a U.S.-based public-issuer client.
The person pretending to be an employee of the issuer, instructed American Stock Transfer to issue millions of new shares of the issuer, liquidate those shares and send the proceeds to an overseas bank. The SEC found that American Stock Transfer followed these instructions and transferred approximately USD4.78 million to bank accounts located in Hong Kong.American Stock Transfer was able to recover approximately USD1 million.
In addition, the SEC found that, around April 2023, in an unrelated incident, a persion used stolen Social Security numbers of certain American Stock Transfer account holders to create fake accounts that were automatically linked by American Stock Transfer to real client s'accounts based solely on the matching Social Security numbers, even though the names and other personal information associated with the fraudulent accounts did not match those of the legitimate accounts.
This allowed the person to liquidate securities held in the legitimate accounts and transfer a total of approximately USD1.9 million in proceeds to external bank accounts. American Stock Transfer was able to recover approximately USD1.6 million.
The SEC found that the company breached Section 17A(d) of the Securities Exchange Act of 1934 and Rule 17Ad-12 thereunder. In addition to a civil penalty of USD850,000 Equiniti agreed to a cease-and-desist order and censure in order to settle the action.



