SEC Inspector General Report on Former Employee Data Breach Validates ASA's Warnings on Consolidated Audit Trail

WASHINGTON – The American Securities Association (ASA) today called on the Securities and Exchange Commission (SEC) to accelerate the elimination of retail investor personally identifiable information from the Consolidated Audit Trail (CAT), following a report by the SEC's Office of Inspector General (OIG) finding that a former employee improperly accessed and shared nonpublic investigative information.

"This breach is exactly what ASA has been warning about for years, and it should never have been allowed to happen in the first place," said ASA President and CEO Chris Iacovella. "When thousands of people have access to sensitive financial and personal data, it is not a matter of if there will be a breach, it is a matter of when. The CAT Customer and Account Information Data identifier— the CCID — is not a technical workaround that solves the personal data problem, it is the problem, and it is time for the SEC to stop using retail investors' personal and financial information to track them around our markets."

The OIG report underscores a systemic vulnerability ASA has repeatedly flagged. The CAT is required to support a minimum of 3,000 simultaneous users — including Commission staff, self-regulatory organization employees, plan processor personnel, and contractors — each with access to every trade, from every account, from every broker, for every retail investor in America. The CCID links every such download to a permanent record of every trade ever made by every investor in the database, creating a comprehensive financial surveillance dossier on American investors that grows more dangerous with every security lapse.

ASA has urged the SEC to immediately suspend all collection and use of retail investor PII, end the use of individual customer identifiers, order an emergency independent cybersecurity audit, and work with Congress to enact the Protecting Investors' Personally Identifiable Information Act. Today's OIG report makes clear that the status quo is not acceptable and that further delay puts American investors at risk.

###

The American Securities Association (ASA) represents the retail and institutional capital markets interests of regional financial services firms who provide Main Street businesses with access to capital and advise hardworking Americans how to create and preserve wealth. ASA’s mission is to promote trust and confidence among investors, facilitate capital formation, and support efficient and competitively balanced capital markets. This mission advances financial independence, stimulates job creation, and increases prosperity. The ASA has a geographically diverse membership of almost one hundred members that spans the Heartland, Southwest, Southeast, Atlantic, and Pacific Northwest regions of the United States.