Tag Archives: michael borgia

SEC v. Covington: Federal Court Orders Law Firm to Disclose Names of Clients Affected by Firm’s Cyberattack

by Michael Borgia and Tyler Bourke

Photos of the authors

Left to right: Michael Borgia and Tyler Bourke (photos courtesy of Davis Wright Tremaine LLP)

The court’s decision may embolden the SEC and other regulators to subpoena law firms, response vendors, and software providers in cybersecurity investigations  

The U.S. District Court for the District of Columbia recently issued its highly anticipated ruling in the subpoena fight between the U.S. Securities and Exchange Commission (“SEC” or “Commission”) and the law firm Covington & Burling LLP (“Covington”).  On July 24, 2023, the court in SEC v. Covington[1] ordered the firm to comply in part with an SEC administrative subpoena that had been served on the firm in March of 2022 by providing the names of seven firm clients, the material nonpublic information of which had been compromised in a cyberattack on Covington’s information technology systems in November 2020. 

Continue reading →

Federal Court Holds Financial Institution Liable for Business Email Compromise Loss

by Michael Borgia, Dsu-Wei Yuen, Andrew Lorentz, and Michael Buckalew

Photos of the authors

From left to right: Michael Borgia, Dsu-Wei Yuen, and Andy Lorentz (Photos courtesy of Davis Wright Tremaine LLP)

While ransomware attacks usually grab the headlines, business email compromise (BEC) attacks continue to cause massive financial losses for businesses. The FBI’s Internet Crime Complaint Center (IC3), reported BEC losses in the United States of nearly $2.4 billion in 2021.[1]  And the problem grew worse during the COVID-19 pandemic: losses from BECs increased 65 percent globally from July 2019 to December 2021.[2] 

BECs typically involve a variety of social engineering techniques (for example, domain spoofing) to obtain credentials for a corporate email account.  Once inside the email account, attackers typically search for discussions of upcoming vendor payments or other financial transactions and trick victims into transferring funds to an attacker-controlled bank account, instead of the account of the legitimate recipient.  A very common type of BEC involves an attacker posing as a company’s vendor and emailing “updated” bank account details for electronic payment of the vendor’s invoices.  While these misdirected funds sometimes can be recovered through quick reporting to the involved financial institutions and law enforcement, recovery efforts often are difficult. Attackers promptly disperse the funds by transferring them to multiple foreign bank accounts or converting them to cryptocurrency and transferring them to multiple wallets. 

Continue reading →