www.marketwatch.com Open in urlscan Pro
65.9.63.83  Public Scan

Form analysis
0 forms found in the DOM

Text Content

Skip to main content

Advertisement

 * Home
 * Latest News
 * Watchlist
 * Market Data Center
    * U.S.
    * Cryptocurrency
    * Europe
    * Rates
    * Asia
    * Futures
    * Currencies

 * Markets
    * U.S. Markets
    * Canada
    * Europe & Middle East
    * Asia
    * Emerging Markets
    * Latin America
    * Market Data

 * Investing
    * Barron's
    * Best New Ideas
    * Stocks
    * IPOs
    * Mutual Funds
    * ETFs
    * Options
    * Bonds
    * Commodities
    * Currencies
    * Cryptocurrencies
    * Futures
    * Financial Adviser Center
    * Cannabis
    * Newswires

 * Barron's
 * Economy & Politics
    * Washington Watch
    * Inflation
    * Coronavirus
    * The Federal Reserve
    * Economic Report
    * Rex Nutting
    * U.S. Economic Calendar
    * Coronavirus Recovery Tracker

 * Personal Finance
    * The Moneyist
    * Spending & Saving
    * Retirement
    * TaxWatch
    * Credit Cards
    * Careers
    * Travel
    * Real Estate
    * Real Estate Listings

 * Retirement
    * Best New Ideas in Retirement
    * Estate Planning
    * Help Me Retire
    * FIRE
    * Taxes
    * Social Security
    * Real Estate
    * Retirement Calculator
    * NewRetirement Planner
    * Where Should I Retire
    * Best Places

 * How to Invest
 * Virtual Stock Exchange
 * Video
    * SectorWatch
    * The Moneyist
    * Getting to Work With
    * Love & Money
    * Explainomics
    * Good Company

 * Podcasts
 * Live Events
 * Picks
    * Food & Wine
    * Home & Kitchen
    * Health & Fitness
    * Fashion & Beauty
    * Loans & Mortgages
    * Money
    * Travel
    * Gifts
    * Technology
    * Real Estate
    * Amazon Prime Day
    * Black Friday
    * Guides

 * Opinion
 * Investor's Business Daily
    * Leaderboard
    * SwingTrader
    * MarketSmith
    * IBDLive

 * Newsletter Center
 * Research & Tools
    * Watchlist
    * Mortgage Calculator
    * Multiple Quotes Tool
    * Stock Screener
    * Earnings Calendar
    * Market Screener
    * IPO Calendar
    * Short Interest
    * Premarket Screener
    * Options Calendar
    * After Hours Screener
    * Currency Tools
    * Mutual Fund Screener
    * Upgrades & Downgrades
    * Mutual Fund Comparison
    * Economic Calendar
    * Where Should I Retire?
    * Savings Accounts
    * Retirement Planner
    * CDs
    * Mortgage Rates

Sign Up Log In
 * Profile Settings
 * Watchlist
 * Email & Alerts
 * Games


MARKETWATCH SITE LOGO A LINK THAT BRINGS YOU BACK TO THE HOMEPAGE.

 * Latest
 * Watchlist
 * Markets
 * Investing
 * Personal Finance
 * Economy
 * Retirement
 * How to Invest
 * Video Center
 * Live Events
 * MarketWatch Picks
 * More
   Latest Watchlist Markets Investing Personal Finance Economy Retirement How to
   Invest Video Center Live Events MarketWatch Picks


 * Account Settings
 * Log In
 * Sign Up


Advertisement

Advertisement

 1. Home
 2. Investing
 3. Barron's
 4. Feature

> Barron's Article Logo A link that brings you back to the Barron's section
page.
Find the latest Barron's stories on MW for well-rounded coverage and more expert
financial advice you can trust.


HOW A RUSSIAN EXEC ALLEGEDLY HACKED LITTLE-KNOWN FIRMS TO GET TESLA, IBM
EARNINGS EARLY

Last Updated: Feb. 1, 2022 at 11:51 a.m. ET First Published: Feb. 1, 2022 at
3:00 a.m. ET
By

BILL ALPERT

  comments

Illustration by Stephan Schmitz
 * Email icon
 * Facebook icon
 * Twitter icon
 * Linkedin icon
 * Flipboard icon

 * Reprint
 * Print icon
 * Resize icon


REFERENCED SYMBOLS


Advertisement
TSLA
+0.51%
MSFT
+0.02%
IBM
-0.71%
DFIN
-0.38%
7911
+1.24%
RRD
+0.75%
SHLDQ
+53.85%
WK
-0.13%
AVT
+0.77%
STLD
+1.34%
MMM
-0.09%
NLSN
+0.25%
KSS
+2.28%
HXL
+1.02%
ROKU
+0.62%
HUBS
+0.41%
MLM
+0.20%
SNAP
-5.94%
IBKR
+0.58%

Hackers may have found a new way to get their hands on inside information for
stock trading.

Two indictments unsealed Dec. 20 in Boston’s federal court allege that a group
led by a Russian cybersecurity executive stole early looks at unannounced
earnings—making over $82 million trading ahead of unreleased announcements from
Tesla (ticker: TSLA), Microsoft (MSFT), IBM (IBM), and over 165 other companies.
But Vladislav Klyushin and his four co-defendants aren’t alleged to have hacked
those companies. Instead, prosecutors charge that the hackers targeted a
little-known choke point for market-moving information: two firms that thousands
of public companies use to make electronic filings with the U.S. Securities and
Exchange Commission.

It’s one of the largest hackings of inside information on stocks ever charged,
and the case is likely to shine an uncomfortable light on an obscure but crucial
industry that handles the market’s most-sensitive information.


Advertisement

Charging documents from the Department of Justice, and a parallel civil case by
the SEC, conceal the names of the two filing services. The SEC complaint
describes “Servicer A” as a Chicago-based company, and “Servicer B” as a
division of a foreign company. Barron’s was able to determine that Servicer A is
Chicago-based Donnelley Financial Solutions (DFIN), while Servicer B is the
Toppan Merrill unit of Japan’s Toppan (TOPPY). That’s because the SEC’s public
archive, known as Edgar, has digital copies of the earnings announcements
mentioned in the criminal case, and each filing names the responsible filing
service.

Federal prosecutors in Boston allege that the Klyushin group stole computer
passwords from the filing agents’ employees and then roamed the firms’ networks
from 2017 through 2020 to steal copies of more than 500 unannounced earnings
drafts. After his arrest in Switzerland and extradition to Boston, Klyushin
pleaded not guilty at his Jan. 5 arraignment before U.S. Magistrate Judge
Marianne Bowler. The judge declined to release him on bail. His co-defendants
remain at large and aren’t represented in court.

Toppan Merrill acknowledged to Barron’s that it is one of the filing agents
described in the indictments of the hacking ring. “Toppan Merrill has been
cooperating fully with government authorities in support of their investigations
in this matter,” the company’s general counsel Lisa Bilcik wrote in an email.
“We have communicated with the limited set of customers whose information was
allegedly accessed and used in the illegal trading scheme.” Toppan Merrill
declined to comment further.

Donnelley Financial did not respond to repeated requests for comment, and it has
never publicly spoken about the hacking cases. On its website, DFIN—as Donnelley
Financial now styles itself—tells potential customers that its ActiveDisclosure
system is secure. “Unsurpassed security gives you peace of mind,” says the
website. “At DFIN, we successfully handle some of the most sensitive documents
in the world thanks to our best-in-class security architecture and fraud
detection solutions.”

Donnelley Financial and Toppan Merrill are remnants of a once-thriving financial
printing industry, relied upon by Wall Street to confidentially prepare the
prospectuses, proxies, and sensitive announcements of public companies. As ink
and paper gave way to electronic files, financial printers evolved into software
suppliers hired by public companies and investment funds to securely format and
submit the SEC filings that contain some of the most actionable trading
information on the planet.

“[N]o company is immune to attack; anyone who promises otherwise is lying.”

— Workiva’s Eric Anders

The Donnelley Financial business was spun off in 2016 from R.R. Donnelley & Sons
(RRD)—the 150-year-old Chicago firm that had been America’s largest printer,
producing catalogs for Sears Roebuck and magazines for Time Inc. The first-known
infiltration of the filing agent’s systems was in October 2017, according to
prosecutors: a year after Donnelley Financial first traded on the New York Stock
Exchange for $28 a share.

Nearly every public company now uses the software systems of three firms:
Donnelley Financial, Toppan Merrill, or the Ames, Iowa–based Workiva (WK).



At Workiva, the filing firm that wasn’t involved with the alleged hacks, chief
information security officer, Eric Anders, expressed sympathy for his rivals.
“Let’s be clear,” he blogged, after the unsealing of the hacking case, “[N]o
company is completely immune to attack, and anyone who promises otherwise is
lying.”


Advertisement

In a March 2021 affidavit filed by prosecutors to obtain Klyushin’s arrest
warrant, Federal Bureau of Investigation agent B.J. Kang alleged that the
hacking group penetrated one of the filing agents in November 2018 and used
inside information to buy or sell short shares of its clients, including IBM,
Avnet (AVT), Steel Dynamics (STLD), and 3M (MMM). Public filings at the SEC show
that those firms were clients of Toppan Merrill.

Infiltration of the second filing agent began in 2017, Kang alleged, allowing
the conspirators to trade ahead of the announcements of a long list of that
filing service’s customers, which included Tesla, Grubhub, Nielsen Holdings
(NLSN), Kohl’s (KSS), Hexcel (HXL), Roku (ROKU), HubSpot (HUBS), Martin Marietta
Materials (MLM), and Snap (SNAP). The SEC Edgar database shows that Donnelley
Financial was the filing agent for those companies, and dozens of others
mentioned in the FBI affidavit.

Barron’s queried the public companies whose announcements were alleged to have
been stolen. Only Nielsen Holdings would comment, saying that the charges
unsealed in December were its first notice of the alleged inside trading.
Nielsen says it has asked for more information from its filing agent, Donnelley
Financial.


One of the four co-defendants alleged to have carried out the intrusions, Ivan
Yermakov (or “Ermakov”), worked for Klyushin’s Moscow-based cybersecurity firm,
M-13, prosecutors say. The 35-year-old Yermakov, they say, is a veteran of the
Russian military intelligence agency known by the initials GRU. While at GRU,
according to a 2018 federal indictment, Yermakov infiltrated the computers of
the Democratic Party and the campaign of Hillary Clinton, ahead of the 2016
elections. A second indictment in 2018 charged him with hacking antidoping
agencies, sports federations, and antidoping officials, as well as the nuclear
reactor unit of Westinghouse Electric, the international agency against chemical
weapons, and a lab that had investigated suspected Russian poisonings in the
United Kingdom.


Advertisement

Yermakov remains at large, and no charges were lodged against M-13.

The U.S. Treasury sanctioned Yermakov in 2018 for his alleged hacking of the
2016 election, and an FBI wanted poster seeks him for the election and
sports-doping-related charges. No attorney has appeared for him in any of the
U.S. proceedings, including the recent stock trading cases. Yermakov appears
never to have commented publicly on his U.S. indictments, and his social media
accounts were closed down after the first case filings.

The M-13 cybersecurity firm where Klyushin employed Yermakov is hired by its
clients to attempt computer attacks in an exercise known as penetration testing,
according to its website. The website listed clients that include Russian
government agencies and the office of President Vladimir Putin. In June 2020,
Putin awarded Klyushin a national medal of honor. M-13 did not respond to
requests for comment.

Klyushin’s activities have left him well off, say prosecutors. In arguing that
he posed a flight risk if released on bail, prosecutors presented photos they
say Klyushin sent Yermakov, showing a safe with an estimated $3 million in $100
bills. Klyushin has a $2 million London apartment and a $4 million yacht,
according to court filings.

The attorney representing Klyushin in the federal criminal case did not respond
to queries. Letters to Judge Bowler, purporting to come from Klyushin’s
employees, praised Klyushin’s fairness and generosity, saying that he paid their
medical bills and took them on retreats to resorts like the Russian city of
Sochi. He paid to repair the roof of Moscow’s Sretensky Monastery, said one
writer, and loved pets and nature. “I can’t imagine a situation in which
Vladislav could hurt someone or wish evil,” wrote his second wife, Zhannetta
Kliushina. “Vladislav cannot commit what he is accused of.”


Advertisement

Previous criminal cases have charged overseas hackers with stealing advance
knowledge of market-moving information from public relations newswires, the SEC
itself, or from merger-and-acquisition lawyers. Only the illicit gains alleged
in the newswires case exceeded the $82.5 million that Klyushin and his
co-defendants are charged with reaping.

According to the latest federal charges, Yermakov stole log-in credentials from
employees of the two filing agents and installed malware that allowed him to
query their networks from over 100 rotating, anonymous internet addresses
associated with locations around the world. He had bought and established the
fictitious addresses using cryptocurrency to cover his tracks, say prosecutors.
Klyushin and others allegedly traded on the stolen information in the hours and
days before the announcements became public. A statistical analysis by the SEC
claims that the probability that the group would have traded as it did around
the companies’ earnings—by chance alone—is one in a trillion.

In prosecutors’ filings, they cite an array of evidence that includes photos and
text messages exchanged by Klyushin, Yermakov, and their associates, as well as
trading records from Interactive Brokers Group (IBKR) and brokers in the U.K.,
Denmark, Russia, Cyprus, and Portugal. None of the brokers have been accused of
wrongdoing.

In a June 2020 exchange of texts, prosecutors say, Yermakov told Klyushin that
they needed to go to work to make money to buy an apartment. Klyushin responded
that there was no need to do that, because they just had to “turn on the
computer” to make money, according to prosecutors.

Write to Bill Alpert at william.alpert@barrons.com,


Advertisement

MOST POPULAR


Advertisement

‘HE’S ALWAYS BEEN A SHADY CHARACTER’: MY UNCLE ASKED ME TO SIGN A DOCUMENT
SAYING THAT I’D NO RIGHTS TO MY GRANDFATHER’S LAND. I DIDN’T SIGN IT. WHAT NOW?

FORECASTER WHO CALLED BITCOIN’S ‘SKYSCRAPER’ TOP SAYS THIS COMPANY REMAINS THE
SMARTEST DIGITAL/FINTECH PLAY

‘HE WALKED OUT ON OUR MARRIAGE 2 YEARS AGO AND DISAPPEARED’: HOW DO I SERVE MY
MISSING HUSBAND WITH DIVORCE PAPERS? HE OWES ME THOUSANDS OF DOLLARS

INTEREST RATES ARE SET TO RISE. HERE ARE 3 EQUITY SECTORS TO CONSIDER

PELOTON’S NEW CEO GETS A LOWERED BAR AS COMPANY AGAIN CUTS OUTLOOK


Advertisement



READ NEXT


READ NEXT


BARRON'S: GIANT PENSION SOLD APPLE, INTEL, AND QUALCOMM STOCK. HERE’S WHAT IT
BOUGHT.

Dutch pension PGGM cut investments in Apple, Intel, and Qualcomm in the fourth
quarter, and started a position in Nvidia.


MORE ON MARKETWATCH

 * Tax season: does the IRS know if you trade crypto? Is your NFT sale or mining
   income taxable?
 * Barron's: Peloton Stock Soars as Takeover Reports Heat Up. How Much It Might
   Be Worth.
 * Barron's: Apple, Not Amazon, Should Buy Peloton. Here’s Why.
 * Barron's: Here Are the Tech Stocks to Buy After a Crazy Week of Earnings

Community Guidelines • FAQs

Back to Top
MarketWatch logoGo to the homepage
Copyright © 2022 MarketWatch, Inc. All rights reserved.
By using this site you agree to the Subscriber Agreement & Terms of Use, 
Privacy Notice, and Cookie Notice.
 * Facebook
 * Twitter
 * Linkedin
 * 

 * MARKETWATCH

 * Customer Center
 * Contact Us
 * Newsroom Roster
 * Virtual Stock Exchange
 * BigCharts
 * Copyright Policy
 * Manage Notifications

 * COMPANY

 * Dow Jones
 * Code of Conduct
 * Corrections
 * Reprints & Licensing
 * Your Ad Choices
 * Corporate Subscriptions
 * Accessibility

 * DOW JONES NETWORK

 * The Wall Street Journal
 * Barron's
 * Financial News London
 * realtor.com
 * Mansion Global

Intraday Data provided by FACTSET and subject to terms of use. Historical and
current end-of-day data provided by FACTSET. All quotes are in local exchange
time. Real-time last sale data for U.S. stock quotes reflect trades reported
through Nasdaq only. Intraday data delayed at least 15 minutes or per exchange
requirements.



Advanced Search Submit entry for keyword results

Advertisement



LISTINGS




COLUMNS




AUTHORS




TOPICS





PRIVATE

No results found