The U.S. Securities and Exchange Commission released an investigative report earlier this month detailing how spoof emails at nine publicly traded companies caused them to lose approximately $100 million in total.

The method of attack was similar for each company: Perpetrators sent emails to employees of the unnamed companies purporting to be executives seeking a wire transfer, or a vendor looking for any unpaid invoices.

More recently, Voya Financial Advisors Inc. last month agreed to pay $1 million to settle charges with the SEC in connection with an April 2016 cyber-intrusion that compromised more than 5,600 customers' personal information under a formerly unused statute; and in April the SEC took its first enforcement action for failure to disclose a data breach against the company formerly known as Yahoo, which paid a $35 million penalty for the massive breach.

Corporate Counsel spoke with Britt Latham, chair of the securities litigation practice group at Bass, Berry & Sims in Nashville, about the investigative report and what it means for companies going forward. Latham said that though the SEC chose not to bring enforcement actions against the affected companies, the SEC report shows that the commission is scrutinizing these types of fake email incidents and sending a message to publicly traded companies that complying with federal securities laws requires them to identify and address such cybersecurity risks. In February, the SEC issued guidance on the subject.

Here are excerpts from that conversation, edited for brevity and clarity.

Corporate Counsel: Just to begin, what is an email spoofing attack?

Britt Latham: It's sometimes what the SEC calls a business email compromise. It's someone pretending to be someone that they're not, in simple terms. This SEC investigative report that came out on Oct. 16, the SEC was looking at nine public companies that were the victims of cyber-related fraud. In each of those, the company was the victim of an email from a fake executive or an email from a fake vendor which requested a wire transfer for payment of monies either from the executive or owed to the vendor.

Are these sophisticated attacks that are difficult to detect?

They'll [the hackers] will get the information from the executive and will send it. Sometimes it's one letter or one number off and will send it to someone in the company. It's interesting, the ones from the executives the SEC designated as “not sophisticated” because they were just an email from the purported executive to the chief financial officer or some employee asking to wire money. They acknowledged that the ones from the vendors were a little more sophisticated because they involved some hacking to get certain information and had invoices that looked real. They're using real law firms' names and the real names of accountants. They're putting decent bait in the water, if you will.

What are some ways to prevent these kinds of attacks?

I do think training is a big part of that. All companies need to learn as more of these are reported. That's a big part of the why the SEC issued the report. They want companies to read this, understand these schemes, be reminded to address the risk of internal controls and in some sense remind the companies that the failure to have the internal controls may violate the federal securities law.

In addition to training to help identify these things, I'm not sure beyond additional internal controls. If you take these nine instances, you need to make sure you have policies and procedures where you have two-person approval on large invoices over a certain amount, and then abide by those polices.

The SEC chose not to impose any civil penalties in these instances. Why do you think that is?

The SEC has been reluctant to pile on and seek action against companies that have been victimized. But on the other hand, they have an obligation to protect shareholders. I think companies will see this report as a warning that they've got an obligation to do all they can do to prevent the intruders from coming into the house, and if they don't lock the doors and windows properly, they can be punished for that.

I think the SEC is inching closer to the point where they're going to take action on companies that don't have adequate safeguards. If you look at instances where confidential information of customers or third parties has been involved, the SEC is much more likely to pursue an enforcement action.