A broker-dealer agreed to pay a $650,000 fine because an OSJ’s cloud server vendor failed to protect customer information. FINRA asserts that foreign hackers penetrated the cloud-based servers and had access to customers’ nonpublic personal information. FINRA faults the firm for failing to monitor or test the third party vendor’s information security. FINRA also alleges that the BD failed to adopt reasonable data security policies that included specific firewall policies and related testing. FINRA cites violations of Rule 30 of Regulation S-P, which requires the protection of customer records and information.
OUR TAKE: Firms must go the extra mile to protect customer information and not just rely on hiring a third party. FINRA will hold BDs strictly liable for data breaches, even those occurring at the vendor.