INTERCONTINENTAL EXCHANGE INC

In May 2024, the SEC charged Intercontinental Exchange and nine wholly-owned subsidiaries — including the New York Stock Exchange, NYSE American, NYSE Arca, NYSE Chicago, NYSE National, ICE Clear Credit, ICE Clear Europe, Archipelago Trading Services, and the Securities Industry Automation Corporation — with failing to timely inform the SEC of a cyber intrusion as required by Regulation Systems Compliance and Integrity (SEC Press Release 2024-63). ICE agreed to pay a $10 million penalty.

In April 2021, a third party informed ICE that it was potentially impacted by a system intrusion involving a previously unknown vulnerability in ICE's VPN. ICE investigated and determined that a threat actor had inserted malicious code into a VPN device used to remotely access ICE's corporate network. ICE personnel did not notify the legal and compliance officials at ICE's subsidiaries for several days, in violation of ICE's own internal cyber incident reporting procedures. The subsidiaries were therefore unable to fulfill their independent regulatory obligation to immediately contact SEC staff and provide an update within 24 hours. The case established that delayed internal escalation of a cyber incident can trigger entity-level penalties even when the intrusion itself caused limited technical damage.