Equifax headquarters, Atlanta Equifax headquarters, Atlanta (Photo: John Disney/ALM)

The former chief information officer of a division at Equifax has been charged with insider trading stemming from stock sales he made following a massive data breach, according to the Securities and Exchange Commission.

Byung J. “BJay” Pak, U.S. attorney for the Northern District of Georgia in Atlanta, has filed criminal charges against Jun Ying, who was in line to be the Atlanta-based credit bureau’s next global chief information officer when the Atlanta-based company was hacked last year, the SEC announced Wednesday.

Ying, who was indicted on the criminal charges Tuesday, will be arraigned later this week before U.S. Magistrate Judge Linda T. Walker.

The SEC accuses Ying of capitalizing on confidential company information to cash in his stock options in advance of Equifax’s public announcement of a massive data breach. Equifax has said the hack potentially compromised personal and financial data of an estimated 148 million consumers.

Equifax discovered the hack in July 2017 but did not notify the public until September.

The SEC complaint claims Ying exercised all of his vested stock options and sold the shares for nearly $1 million prior to public disclosure of the hack. In doing so, Ying avoided more than $117,000 in losses, the SEC said.

“Ying used confidential information to conclude that his company had suffered a massive data breach, and he dumped his stock before the news went public,” said Richard R. Best, director of the SEC’s Atlanta Regional Office. ”Corporate insiders who learn inside information, including information about material cyber intrusions, cannot betray shareholders for their own financial benefit.”

On Wednesday, Equifax interim Chief Executive Officer Paulino do Rego Barros Jr. issued a statement saying, “Upon learning about Mr. Ying’s August sale of Equifax shares, we launched a review of his trading activity, concluded he violated our company’s trading policies, separated him from the company and reported our findings to government authorities. We are fully cooperating with the DOJ and the SEC, and will continue to do so. We take corporate governance and compliance very seriously, and will not tolerate violations of our policies.”

Do Rego Barros said Ying’s indictment and the SEC civil complaint are unrelated to four executives who, in November, were found by a special committee of Equifax’s board of directors not to have engaged in insider trading. An independent investigation concluded that the four executives complied with company policy and were not aware of the breach at the time they sold company shares. Ying sold shares nearly a month after the trades by the four executives. 

According to the SEC complaint, Ying, a 42-year-old Atlanta resident, was an Equifax employee from January 2013 until October 2017, and the CIO of Equifax’s U.S. Information Solutions (USIS) business unit. Ying was was offered the job as global CIO on Sept. 15, a week after Equifax went public with the hack. As CIO of USIS, Ying was often entrusted with nonpublic information about Equifax, according to the SEC.

Two other Equifax corporate officers also have been accused in civil class action complaints filed by consumers in pending multidistrict litigation in Georgia of similarly exercising their stock options in advance of the credit bureau’s public announcement of the hack. Those suits contend Equifax Chief Financial Officer John Gamble sold Equifax shares worth $946,3874; Joseph Loughran, president of Equifax’s USIS, exercised options to sell stock worth $584,099; and Rodolfo Ploder, president of the company’s workforce solutions, sold $250,458 worth of stock. None of them has been charged or named as defendants in SEC complaints.

According to federal prosecutors, Ying texted a co-worker on Aug. 25 that the breach they were working on “Sounds bad. We may be the one breached.” Ying conducted web searches that following monday on the impact of a 2015 data breach on Experian’s stock price. Later that morning, Ying exercised all of his available stock options held at UBS Financial Services, resulting in his receiving 6,815 shares of Equifax stock, which he then sold.

He received more than $950,000 and realized a gain of over $480,000.

— Check out Sen. Warren Blasts Equifax for Lax Cybersecurity in Report on ThinkAdvisor.