The
US Securities and Exchange Commission (SEC) has charged nine defendants in
connection with a scheme to hack into SEC systems and profit from corporate information
not yet released to the public.

The
defendants, a Ukrainian hacker, six traders in California, Ukraine and Russia,
and two entities, allegedly participated in a scheme to hack into the SEC’s
EDGAR system and extract non-public information to trade stocks ahead of public
announcements that would affect share prices.

The
key figure in this case is 27-year-old Ukrainian hacker Oleksandr Ieremenko,
who had earlier allegedly hacked newswire services seeking insider information.
The SEC says, after the newswire hack, Ieremenko turned his attention to the
SEC’s Electronic Data Gathering, Analysis, and Retrieval (EDGAR), an online system
used by companies listed on stock exchanges to submit quarterly and annual
financial results. The filings also include sensitive corporate information on subjects
like mergers and acquisitions, which heavily affect a company’s share price.

“The information was passed to individuals who used it to trade in the narrow window between when the files were extracted from SEC systems and when the companies released the information to the public,” the press release states. “In total, the traders traded before at least 157 earnings releases from May to October 2016 and generated at least $4.1 million in illegal profits.”

The SEC says Ieremenko circumvented EDGAR controls that require user authentication, then navigated within the EDGAR system to obtain quarterly earnings not yet public. He allegedly passed the information to different groups of traders which paid him either through regular fees or “by kicking back a portion of their trading profits,” according to the indictment (PDF). The document also says that the hacker’s main attack vector was phishing emails.

According
to the complaint, the traders on the receiving end of the hacked EDGAR
information are:


Sungjin Cho, Los Angeles, California


David Kwon, Los Angeles, California


Igor Sabodakha, Ukraine


Victoria Vorochek, Ukraine


Ivan Olefir, Ukraine


Andrey Sarafanov, Russia


Capyield Systems, Ltd. (owned by Olefir)


Spirit Trade Ltd.

Ieremenko
has yet to be detained, according to the documents. He is currently charged
with 16 counts of hacking and fraud. The SEC’s investigation is ongoing.