It was the summer of 2017 and the consumer credit reporting agency Equifax was preparing to announce a massive data breach that compromised sensitive information of 148 million of its U.S. customers.
Company officials tapped software engineering manager Sudhakar Bonthu to create a website for affected consumers. Bonthu was told the work was for a client, but the software engineer figured out that his own company was the victim, according to the Securities and Exchange Commission.
Bonthu then began buying Equifax put options, which would allow him to profit if the underlying stock dropped in price, the SEC said. According to court records Bonthu bought 86 put options in Equifax stock using his wife’s Fidelity brokerage account.
Less than a week later, on September 7, Equifax announced the data breach, its stock declined, and Bonthu sold the put options. Securities regulators said he made more than $75,000.
“Bonthu, who was entrusted with confidential information by his employer, misused that information to conclude that his company had suffered a massive data breach and then sought to illegally profit,” said Richard Best of the SEC’s Atlanta Regional Office.
“Corporate insiders simply cannot abuse their access to sensitive information and illegally enrich themselves.”
It was the second time this year that an employee at the embattled consumer credit rating agency has been charged with insider trading.
Bonthu, who was fired from Equifax in March, agreed to settle the SEC charges by paying back the ill-gotten gains plus interest. He also faces criminal charges brought by federal prosecutors in Atlanta.
Earlier this year an Equifax executive, Jun Ying, was charged with insider trading stemming from the data breach.
On Wednesday Equifax agreed to new data security rules under a consent order with eight states: Alabama, California, Georgia, Maine, Massachusetts, New York, North Carolina and Texas.
In a statement, Equifax said that “upon learning of potential trading activity by Mr. Bonthu, we immediately launched a review of his trading activity and separated him from our company after he declined to cooperate with our inquiry.
“We are fully cooperating with the SEC and the Department of Justice, and will continue to do so,” the statement said. “We take corporate governance and compliance very seriously, and will not tolerate violations of our policies.”
