D.D.C.: SEC admin subpoena for law firm cyberattack was narrowed to only affected clients

Covington & Burling was the target of a cyberattack, and the SEC investigated. It wanted the names of all affected clients, but C&B resisted, seeking narrower disclosure. The law firm agreed that only certain affected clients should be disclosed, and the SEC agrees to the narrowing. SEC v. Covington & Burling, 2023 U.S. Dist. LEXIS 127205 (D.D.C. July 24, 2023):

The court finds some merit to both parties’ positions, but ultimately holds that the SEC’s demand for the names of affected clients does not exceed its statutory authority or cross any constitutional lines. The SEC is not, however, entitled to all affected client names. Its demand is too broad. The agency concedes that it is only interested in the names of those Covington clients whose material nonpublic information was accessed during the cyberattack, and the firm has reported that only a handful of its clients were potentially so impacted. The court therefore will require Covington to disclose the names of the seven clients as to whom it has not been able to rule out that the threat actor accessed material nonpublic information.

Update:

Lexology: Federal Court Grants the SEC Limited Access to the Identities of Law Firm Clients Impacted by a Cyberattack