Attackers exploited a software vulnerability in the test filing component of EDGAR, a corporate filing system. The SEC doesnt believe the event exposed personally identifiable information or produced systemic risk. But it does concede that the attack likely compromised large volumes of nonpublic data. The GAO counted 15 deficiencies that limited the effectiveness of the SECs security controls, such as maintaining up-to-date network diagrams and monitoring key systems security configurations. In a July 2017 report, the SEC overall improved the security controls of its key systems by resolving 47 of the 58 recommendations”]
Source: https://grahamcluley.com/sec-reveals-hackers-might-have-used-stolen-data-for-insider-trading/