The company that owns the Nasdaq Stock Market confirmed over the weekend that its computer network had been broken into, specifically a service that lets leaders of companies, including board members, securely share confidential documents.
The fact that the Web-based service, called Directors Desk, was penetrated could lend credence to one theory that law-enforcement authorities investigating the matter are considering, namely that hackers may be aiming to extract nonpublic inside information that could be used illegally to gain a trading edge.
However, several people with knowledge of the probe say investigators haven’t reached even preliminary conclusions about motive and that other theories, including terrorism, theft or wire fraud, at this point remain equally viable possibilities.
The Wall Street Journal reported Friday night that outsiders had repeatedly penetrated the computer network of Nasdaq OMX Group during the past year. The exchange’s trading platform — the part of the system that executes trades — wasn’t compromised, these people said.
The company and people familiar with the investigation say as far as they can tell no information from Directors Desk was taken or compromised.
On Saturday, Nasdaq said that following the Journal report and after consulting with authorities, it told customers about the incidents. Prior to that, the company said, the Justice Department had asked that it refrain from notifying customers until at the earliest Feb. 14 to facilitate the investigation. A representative for the department declined to comment.
Nasdaq spokesman Frank DeMaria said Sunday that the company detected the security issue in October or November and reported it to the Securities and Exchange Commission, the Federal Bureau of Investigation and the Justice Department.
The files in question were removed and Nasdaq made modifications to the system as a deterrent, he said. He declined to give further details about changes Nasdaq made.
There were indications Sunday that the security issues affecting Nasdaq had engendered broader concerns. NYSE Euronext also has a Web service for corporate-director communications, called eGovDirect.com. NYSE notified customers Wednesday that it was shutting the site for technical reasons, and it remained down in light of those issues and broader security concerns, said a person familiar with the matter. On Sunday, a message on the site said it was temporarily unavailable “due to an unscheduled maintenance activity.”
An NYSE spokesman said the company doesn’t comment on security matters. He said the eGovDirect system is operated separately from NYSE trading.
People familiar with the Nasdaq case say that while the specifics of that hacking aren’t particularly egregious in a world where corporate networks are attacked daily, the case has raised alarms in the government because the implications of compromising Nasdaq, which runs one of the world’s most important exchanges, could be a threat to a key piece of the national and economic infrastructure.
The Secret Service began its investigation more than a year ago, according to people familiar with the matter. Government resources devoted to the effort increased significantly in late 2010, when routine computer security checks by the company revealed hackers had installed so-called malware files inside Directors Desk, the people say. Malware is a term for malicious software created by hackers to help them break into or disrupt computer networks.
Computer experts at the Justice Department and the Department of Homeland Security have been working on the potential threat, according to people familiar with the matter. Officials have also called in the computer emergency response team affiliated with Carnegie Mellon University in Pittsburgh, arguably among the best cyber security experts in the world, the people say. A representative of the school didn’t immediately respond to a request for comment.
The motive behind the hacking penetrations is hard to determine because the hackers don’t appear to have manipulated or taken data from the system, but also because the origin of the attack is still unclear.
Directors Desk is a Web-based system designed to help corporate executives and directors securely share confidential documents such as meeting calendars and financial reports.
One cybersecurity expert, Tom Kellermann, said the fact that Directors Desk was targeted suggests to him that the goal was what he called “virtual insider trading” — hacking into a publicly traded company’s sensitive internal data and making trades on that information before it becomes public.
Mr. Kellermann, a former cyber security expert at the World Bank who now does “penetration testing” of the computer networks of government agencies and major firms, said another possible reason to target that particular part of Nasdaq’s network could be to use it as a means to discover ways to break into Nasdaq clients’ networks.
Two large stock-market operators reached over the weekend, New York Stock Exchange parent NYSE Euronext and Direct Edge, said they planned to continue doing normal business with Nasdaq OMX and would maintain links with Nasdaq that electronically route orders between platforms to find the best price. The BOX Options Exchange said it also planned to maintain links to Nasdaq markets. Officials at BATS Exchange, the International Securities Exchange and the Chicago Board Options Exchange declined to comment.
Traders were guardedly optimistic that U.S. trading would be unaffected on Monday. “We do not expect to modify our order-routing destinations . . . based on the information available at this time and would not be hesitant to continue to use the Nasdaq trading platform,” said Tony Sanfilippo, chief executive of Hudson Securities.
Directors Desk has upward of 10,000 users from hundreds of entities world-wide, including many Fortune 500 companies, according to Nasdaq’s website.
Nasdaq acquired Directors Desk in June 2007 as part of efforts to offer more services to companies as an enticement to list their securities with Nasdaq. Nasdaq marketed Directors Desk until as recently as December, according to people familiar with the matter.
Among the U.S. businesses using Directors Desk is Eastman Kodak Co. A Kodak spokesman said Sunday he wasn’t aware of any impact on the company from the hacking, but Kodak “will be looking into this.”
Another Directors Desk customer is the Financial Industry Regulatory Authority, Wall Street’s private self-policing agency. Finra said none of its regulatory systems are associated with Directors Desk.
Perhaps they were looking for evidence of illegal insider trading?
Leadership List,under to begin anyone encourage sell so victory conversation fruit word contribution recall company talk twice report theme loss settle thought detailed dinner inform right increase flight shoe agree corporate future direct vast twice arrive different drive possibility practical variety tone chair able executive there turn park force equipment address withdraw executive research risk artist sister as damage tax because age add concern cut play speaker leave television belong outside expensive buy forward industry supply word military meet game contain whose please child program choose hide recognise state