US market regulator blames 'SIM swapping' for its X account hack

In a split vote, the commission granted approval the following day.

SIM swapping is a technique in which attackers gain control of a telephone number by having it reassigned to a new device.

"Once in control of the phone number, the unauthorized party reset the password for the @SECGov account," an SEC spokesperson said in a statement.

Law enforcement agencies are working to learn how the hackers prevailed on the SEC's mobile carrier to make the switch, the SEC said, without identifying the carrier.

Lawmakers have demanded explanations as to how the SEC could have left itself exposed to such an attack, when it holds publicly traded companies to tough cybersecurity requirements.

Monday's statement also said that due to difficulties accessing the account, SEC staff had asked X Support in June of 2023 to disable MFA, which can offer added protection against unauthorised access.

"MFA currently is enabled for all SEC social media accounts that offer it," the statement said.

A representative for X did not immediately respond to a request for comment.

US agencies set their own policies on access to social media accounts but guidelines from the US National Institute of Standards and Technology generally encourage the use of MFA, NIST told Reuters.

The incident is under investigation by agencies including SEC's Office of Inspector General and its Division of Enforcement; the Commodity Futures Trading Commission, which regulates bitcoin futures; Federal Bureau of Investigation; Department of Justice; and Cybersecurity and Infrastructure Security Agency, the statement said.