MarketWatch Site Logo A link that brings you back to the homepage.

submited by

Style Pass

2021-08-16 22:00:13

The SEC said its order found that Pearson made misleading statements and omissions about the 2018 data breach involving the theft of student data and administrator log-in credentials of 13,000 school, district and university customer accounts. In its semi-annual report, filed in July 2019, Pearson referred to a data privacy incident as a hypothetical risk, when, in fact, the 2018 cyber intrusion had already occurred. In a July 2019 media statement, Pearson stated that the breach may include dates of births and email addresses, when, the SEC said, it knew that such records were stolen, and that Pearson had "strict protections" in place, when, in fact, it failed to patch the critical vulnerability for six months after it was notified. Pearson's media statement also omitted that millions of rows of student data and user names and hashed passwords were stolen. The order also found that Pearson's disclosure controls and procedures were not designed to ensure that those responsible for making disclosure determinations were informed of certain information about the circumstances surrounding the breach. Without admitting or denying the SEC's findings, Pearson agreed to cease and desist from committing violations of these provisions and to pay a $1 million civil penalty. Write to Chris Wack at chris.wack@wsj.com