Equiniti Trust Company Settles with SEC Over $6.6 Million Cybersecurity Failures

The SEC found that Equiniti Trust Company (formerly AST) experienced two cyber intrusions in 2022–2023 — an email account hijack that enabled fraudulent issuance and liquidation of shares and an SSN-based account-fraud that allowed unauthorized liquidations — resulting in roughly $6.6M in client losses (partial recoveries). Equiniti settled with the SEC, reimbursed clients, agreed to an $850,000 civil penalty, and accepted a cease-and-desist order and censure, highlighting weaknesses in transfer-agent cybersecurity and the need for stronger safeguards.