Case Law On Prosecuting Cyber-Enabled Financial Fraud Targeting Corporations
I. Framework: Cyber‑enabled Financial Fraud Targeting Corporations
Cyber‑enabled financial fraud against corporations refers to schemes in which cyber means (hacking, phishing, stealing information, unauthorized access to networks, misuse of privileged credentials, etc.) are used to commit or facilitate financial misconduct (insider trading, securities fraud, bank fraud, money‑laundering, falsification of accounts) directed at or involving corporations (whether the victim corporation, its systems, or its non‑public sensitive data). Key elements:
Unauthorized access / intrusion into corporate or intermediary computer systems.
Misappropriation of non‑public corporate information or systems.
Financial gain achieved by the fraudsters (trading, diverting funds, falsifying accounts).
Targeting corporations (public companies, financial services firms, corporate service providers) as victims or as the means of the fraud.
Prosecution under various statutes: computer misuse/crime laws (for hacking/unauthorized access), securities laws (for fraud/insider trading), bank/financial fraud laws, money‑laundering statutes.
Global dimension: often multi‑jurisdictional, with foreign actors hacking US‑based corporations or newswires, etc.
Understanding these frauds helps in recognizing that organisations must secure their systems, boards/corporations must manage cyber‑risk, and regulators/prosecutors are now increasingly focusing on cyber‑enabled schemes.
II. Detailed Case Analyses
Here are five (actually six) major cases (or sets of cases) demonstrating how cyber‑enabled financial fraud targeting corporations has been prosecuted. The details illustrate the facts, issues, holdings, and legal/policy implications.
1. Hacking Newswire Press Releases + Insider Trading Scheme (USA)
Facts:
Between 2010 and 2015, hackers based in Ukraine and elsewhere gained unauthorized access into the networks of major business newswire companies (for example Business Wire, Marketwired, and PR Newswire Association LLC). They stole unpublished press releases of publicly‑traded companies (announcements of earnings, revenues, margins) and then provided those inside documents to a set of stock‑traders who placed trades (stocks, options) ahead of the public release, thereby generating illegal profits. Department of Justice+4Department of Justice+4PCWorld+4
Example: More than 150,000 press releases stolen; trades executed ahead of ~800 of them; illegal profits in the tens of millions of dollars. Department of Justice+2OCCRP+2
Issues:
Does hacking into corporate or intermediary computer networks to steal corporate information support liability under computer crime statutes?
Does trading on stolen non‑public corporate information constitute securities fraud / insider trading?
How to attribute the hacking, trading and money‑laundering as part of a coordinated conspiracy?
Holding / Outcome:
In United States v. Korchevsky & Khalupsky (Eastern District of New York) the defendants were convicted of conspiracy to commit wire fraud, conspiracy to commit securities fraud, computer intrusion, money‑laundering. Department of Justice+2Secret Service+2
In parallel, the Securities and Exchange Commission filed civil charges against 32 defendants in 2015 for similar “hack‑to‑trade” schemes. SEC+1
Later pleadings: e.g., Vadym Iermolovych pleaded guilty to conspiracy to commit wire fraud and computer hacking, admitted the scheme. OCCRP+1
Typical penalties: prison, criminal forfeiture, restitution (e.g., Korchevsky and Khalupsky sentenced to 60 months imprisonment and ordered to pay $14.4 million forfeiture. Secret Service
Legal / Policy Implications:
This is a landmark example of cyber‑enabled corporate financial fraud, combining hacking of corporate networks with securities fraud.
Illustrates that corporate service providers (newswire companies) and public firms must guard non‑public information; and that hacking of such systems triggers criminal liability.
Shows the interplay of computer crime laws + securities laws: unauthorized access (computer intrusion), theft of corporate information, trading ahead constitute layered offences.
Demonstrates the need for corporations to ensure cyber‑security, internal controls, and secure distribution of sensitive information.
The case also emphasises cross‑border investigation and global cooperation (hackers abroad, trades executed via offshore accounts).
2. SEC Charges in “Hack the Newswire” Scheme (USA)
Facts:
In August 2015, the SEC announced charges against 32 defendants for a scheme that used hacked, unpublished corporate earnings announcements obtained from newswire services to trade and generate profits of over US$100 million. SEC+1
Issues:
Civil enforcement by SEC: can regulators hold traders and hackers liable for misappropriation of corporate information via hacking?
Does the hacking of intermediary computer networks count as theft of corporate information for purposes of securities laws?
Holding / Outcome:
SEC alleged violation of antifraud provisions of the Securities Exchange Act of 1934. Some defendants faced both civil and criminal enforcement. SEC
Legal / Policy Implications:
Regulators are actively using tools beyond just internal controls of corporations—they are focusing on the cyber‑component of financial fraud.
Shows that corporations must understand that breaches of their supply chain (e.g., newswire services, filing agents) can expose them to regulatory risk indirectly (if their non‑public information is misused).
Helps to clarify liability for hacking combined with trading: the hacking component adds a distinct dimension to market abuse.
3. SEC Charges Five Russians in $80+ Million Hacking + Trading Scheme (USA)
Facts:
In December 2021, the SEC announced charges against five Russian nationals for a multi‑year scheme (2018‑2020) to hack into filing‑agent companies in the U.S., steal unpublished corporate earnings announcements, and trade ahead, generating at least US$82 million. SEC
Issues:
Targeting the systems of intermediaries (filing‑agents) rather than only the corporations themselves.
Use of offshore brokerage accounts (Denmark, UK, Cyprus, Portugal) to execute trades with stolen material non‑public information.
Holding / Outcome:
The SEC’s complaint alleged deceptive hacking, trading based on stolen corporate info, and funneling profits to a Russian IT company. SEC
Legal / Policy Implications:
Reveals that the perimeter of corporate financial fraud includes not only the corporation but its service providers/intermediaries.
Corporations must assess cyber‑risk across third‑party vendors (filing agents, intermediaries) whose security failure can lead to misuse of corporate non‑public information.
Strengthens the argument that corporate boards and compliance functions need to treat cyber‑risk as a financial risk.
4. Singapore Case – Corporate Service Provider & Shell Company Fraud / Money‑Laundering
Facts:
In Singapore, the Money Laundering Risk Assessment Report (2024) identifies a case study: a corporate service provider director (Chai Chung Hoong) failed to exercise due diligence in supervising companies he directed; bank accounts of those companies received criminal proceeds from impersonation and business email compromise (BEC) scams (~US$558,404). acd.mlaw.gov.sg
In addition: On 23 January 2025, a former director of a Singapore corporate service provider (Wang Junjie) was charged with offences including conspiracy to falsify accounts and making false representations to the tax authorities and a bank, linked to a S$3 billion money‑laundering case. The Business Times+2The Straits Times+2
Issues:
Corporate service provider facilitating shell companies used for cyber‑enabled financial fraud (BEC, impersonation scams) targeted at corporations and individuals globally.
Does failure of due diligence / supervision by the CSP director constitute criminal accountability?
Holding / Outcome:
Prosecutors charged the individual under Singapore Penal Code sections for conspiracy to falsify accounts and false representations. The case is ongoing.
The CSP‑linked case is flagged as an example of cyber‑enabled fraud where shell companies and compromised accounts were used for impersonation and financial fraud.
Legal / Policy Implications:
Expands the scope of corporate financial fraud to include facilitators (CSPs, shell companies) supporting cyber‑enabled scams.
Corporations (as victims) must ensure that counterparties and service providers are properly vetted, secure and supervised.
Shows that regulatory and criminal accountability in Singapore is catching up with cyber‑enabled financial crime, not just traditional fraud.
5. Singapore Case – US Server Fraud Investigation (~US$390 million)
Facts:
In Singapore, three men were charged with fraud involving US server sales to Malaysia, mis‐representing the destination and content of servers (worth US$390 million), possible link to export of restricted chips. Although not purely corporate financial fraud in the sense of insider trading, it is a fraud targeting or using corporate supply chain / server sales. CNBC
Issues:
The scheme involved mis‑representation, large scale cross‑border transactions, and companies being deceived about the product destination.
In many such cases, corporate victims are the ones being defrauded.
Holding / Outcome:
The matter is under prosecution in Singapore; the courts are treating it as corporate fraud involving cyber‑enabled supply chain deception.
Legal / Policy Implications:
Highlights that corporate fraud may be cyber‑enabled via mis‑representation of IT infrastructure, hardware, supply‐chain deception.
Corporations must ensure procurement and sales contracts for IT hardware/software are secured, and due diligence performed for technology transactions, especially those with export controls.
6. Additional Example: Chinese Hackers & Law‐Firms – Hacking Corporations via Legal/Deal Services
Facts:
In 2016, hackers (Iat Hong, Chin Hung, Bo Zheng) allegedly hacked law‑firms’ servers in New York to steal confidential data (M&A deal information) belonging to major corporations (e.g., Intermune, Intel Corp, Pitney Bowes). They then used the information for insider trading / profits (~US$4 million). Vanity Fair
Issues:
Use of malware to compromise corporate law‑firm servers (corporate service provider) leading to misuse of corporate non‑public information.
Corporations targeted indirectly via their legal advisors/supply chain.
Outcome:
Charges by U.S. authorities; highlights complexity of corporate financial fraud involving hacking of professional service providers.
Implications:
Shows that corporations must see cyber‑risk beyond their internal networks—to external advisors, legal firms, service providers.
Financial fraud targeting corporations is not limited to trading; the path is often via network compromise of service firms that handle corporate data.
III. Key Legal Principles Emerging
From the above cases, several legal principles stand out:
| Principle | Explanation |
|---|---|
| Unauthorized Access to Corporate / Intermediary Systems = Liability | Hacking into a corporation’s (or intermediary’s) computer network to access non‑public information triggers liability under computer crime laws (e.g., computer intrusion) and when combined with trading/fraud, supports securities or financial fraud prosecution. |
| Misuse of Non‑Public Corporate Information = Financial Fraud | When stolen corporate information (e.g., unpublished earnings) is used to trade or otherwise monetize, liability under securities/financial fraud laws applies. |
| Supply‑Chain / Service‑Provider Risk | Corporations may be victims not only from internal compromise, but from hacking of service providers (newswires, filing agents, law‑firms). Legal obligations are expanding: corporations must control the ecosystem of providers. |
| Global / Multi‑Jurisdictional Character | Many of these schemes involve hackers abroad, offshore trading accounts, shell companies—requiring international cooperation and cross‑border litigation. |
| Corporate Victim Responsibility and Risk Management | While much of the liability is on the offenders, corporations must engage in cyber‑risk mitigation, vendor due diligence, information‑security controls, to prevent being the vehicle of fraud. |
| Facilitator / Enabler Liability | Not only direct hackers and traders, but those who facilitate fraud (shell companies, nominee directors, service providers) may be liable (as seen in Singapore CSP cases). |
| Regulator / Enforcement Focus on Cyber‑Enabled Fraud | Regulatory agencies (like the SEC) are explicitly treating cyber intrusion into corporate systems as a pathway to financial fraud—and prosecuting accordingly. |
IV. Conclusion
Cyber‑enabled financial fraud targeting corporations is a major and evolving threat. The case law above demonstrates that:
Unauthorized access to corporate or intermediary systems, leading to misuse of non‑public information, supports prosecution.
Liability is not just for the hacker but the trader, the facilitator, and even the service provider who fails to perform due diligence.
Corporations must treat cyber‑risk as part of their financial‑fraud risk management, including vendor security, internal controls, and monitoring of sensitive data flows.
Enforcement is global, and the legal exposure for corporations (and their executives) is expanding.
RELATED Blog
0 comments