The SEC's order finds that Flagstar negligently made materially misleading statements regarding the Citrix Breach, resulting in significant data threats and disruption to services.
Flagstar's disclosures suggested a general risk of cyberattacks but failed to reveal already experienced breaches and their serious implications for customer data security.
The Commission found Flagstar did not maintain adequate disclosure controls for cybersecurity incidents, hampering timely assessments and decisions on necessary disclosures.
In communications to customers and in regulatory filings, Flagstar misrepresented the nature and extent of the Citrix Breach, violating securities regulations.
Collection
[
|
...
]