Stay in the know
We’ll send you the latest insights and briefings tailored to your needs
27 5月 2024
Insight
Overview
In the wake of numerous recent high-profile cyber incidents affecting listed entities in Australia, the thorny issues around managing disclosure obligations through a cyber incident have been front of mind for boards.
In response to industry demand for greater guidance around the tricky judgment calls involved in managing market disclosure during a fast-moving cyber incident, ASX has released an updated Guidance Note 8 (GN8) in its Compliance Update no. 06/24 that includes a much-anticipated new data breach example. The new updates take effect from 27 May 2024.
Key takeaways
|
While it would be prudent for listed entities to reassess their cyber incident response manual (including any template ASX announcements) in light of the ASX guidance, it remains the case that disclosure decisions during a cyber incident need to be assessed based on the specific fact pattern that arises. For this reason, regular cyber incident simulations involving disclosure decision points remain essential for Boards and management teams to prepare themselves for a variety of scenarios instead of assuming a ‘one size fits all’ approach.
Recap – GN8 and its relevance
Listed entities’ continuous disclosure obligations are set out in Listing Rules 3.1-3.1B (and given statutory force under sections 674-678 of the Corporations Act 2001 (Cth)). GN8 provides a guide to ASX policy and practice in relation to these obligations. The illustrative examples included in GN8 are used to indicate, at a high level, ASX’s position on the application of Listing Rules for certain scenarios.
It's important to keep in mind that, by necessity, the examples in GN8 are condensed to a digestible length and can’t cover every contingency or fact pattern. The aim of ASX in providing examples is to cover off on some of the key interpretation issues that it is observed in practice when supporting entities in managing their obligations.
The examples are intended to be illustrative only, and should not detract from a ‘first principles’ application of the core disclosure rules at each disclosure decision point – in particular, a fresh assessment of materiality and consideration of whether the confidentiality carve-out applies.
What does the new GN8 example cover?
The new ‘Example I – Data Breach’ focuses on a data breach of a listed entity involving personal information about the entity’s customers. The example is spaced out across eight separate injects that describe the application of continuous disclosure principles at each stage as the hypothetical data breach incident unfolds and more information comes to light.
The example reflects the fact pattern of several recent high-profile cyber incidents, and provides useful illustrative guidance on ASX’s general position on certain live issues concerning cyber incidents (such as the application of the confidentiality exception and the use of trading halts – more on this below).
For businesses whose biggest cyber risk exposure is an incident with operational impacts (such as a ransomware attack where access to the business’ systems is restricted), the new GN8 example does not address this type of scenario. A market disclosure trigger will often occur earlier in a cyber incident with a material operational impact, which reinforces the importance of applying ‘first principles’ around disclosure triggers and timing.
Practical observations – ASX expectations on cyber incidents and disclosure
While not intended to be a complete guide to disclosure during a cyber incident, the new ‘Example I – Data Breach’ includes some very useful and practical insights into ASX’s expectations for engagement with entities during a cyber incident, and the potential timing and content of disclosures.
|
Disclosure is not a ‘default’ starting point |
ASX recognises that an incident that is not sufficiently definite may remain in the territory of ‘disclosure is not required’ for a period of time, even as further information materialises. Applying the disclosure principles, ASX recognises that:
In the specific hypothetical scenario, it is only after the listed entity confirms that the cyber criminal accessed information about a large number of customers that ASX considers a disclosure obligation to be triggered. While in the hypothetical scenario, disclosure is ultimately triggered on those particular facts, it is not always a “given” that the exfiltration of customer information will automatically trigger the continuous disclosure requirement. In our experience, there have been similar scenarios where listed entities have concluded that the consequences of the incident were not market sensitive. |
|
Work swiftly to firm up the fact base |
Unsurprisingly, the hypothetical scenario emphasises that, even where no immediate disclosure obligation is triggered, ASX expects listed entities to continue forensic work with urgency to determine the impact of the data breach, and to reassess whether a disclosure obligation arises as new information becomes known to the entity. |
|
When is confidentiality ‘lost’ |
The new example has helpfully confirmed that engagement with ASX and other regulators on a confidential basis will not automatically result in the information being non-confidential (ie the confidentiality limb of Listing Rule 3.1A may still apply). In practice, entities should be alive to the fact that the scale of stakeholder engagement required in a cyber incident may, in particular instances, be so extensive that there is a high risk of a leak, even where steps are taken to preserve confidentiality. For example, certain incidents may trigger the activation of the National Coordination Mechanism (through the National Office of Cyber Security), which will immediately loop 200-300 representatives from both Federal and state / territory agencies (as well as industry bodies and the private sector as required) into a collaborative forum where information pertaining to the incident will be openly discussed. In addition, we note that the threat of confidentiality being lost is always a possibility when you have cyber criminals in the mix – they could publicise the exfiltrated data at any time without warning, and entities cannot control when or how this would occur (no matter how much they would want to!). In ASX’s hypothetical, release of information onto the dark web is treated as triggering loss of confidentiality and results in the hypothetical entity making a further market announcement (though we note that the hypothetical proceeds on the basis the public release of that particular information is materially price sensitive, which may not always be the case). |
|
Early preparation of draft announcements |
An underlying thread throughout ASX’s example is that ASX encourages an early preparation of draft announcements, with the drafts evolving further as more information comes to light. Any market announcements should be updated prior to release to reflect the market sensitive information the entity is aware of at that time. |
|
No boilerplate announcements |
The example makes clear that ASX’s expectation is that market announcements are accurate, complete (not omitting material information known to the entity), and not misleading – in short, a boilerplate announcement will not be enough. ASX expects the announcement to contain a significant amount of information where available, such as:
However, as the ASX hypothetical illustrates, the content of a market announcement will depend on all facts and actual knowledge available at the time. |
|
Use of trading halts or voluntary suspension |
While ASX accepts that a trading halt or voluntary suspension may be required to manage disclosure obligations during a cyber incident, it signals that these tools should be used sparingly, such as when a disclosure obligation has crystallised and more time is required to prepare a definitive announcement in relation to the scope of the incident. The guidance recommends close engagement with ASX throughout a data breach incident, including if a trading halt or voluntary suspension is considered. Where a trading halt or suspension is granted, ASX expects that the entity should make its market announcement as quickly as possible (ie these measures do not provide relieve the entity of its usual disclosure obligations). |
|
The need for further announcements |
The hypothetical example indicates a view from ASX that further announcements may be required as the factual matrix changes and evolves. It would be oversimplifying to infer that making an initial ASX announcement will automatically necessitate a subsequent announcement for each new development – each specific situation will still involve a fact-based assessment. A subsequent disclosure obligation will arise where:
From a practical perspective, the demand for further information from external stakeholders will be increased once a cyber incident becomes publicly known, so it may also be the case that an entity chooses to make a subsequent announcement via the ASX platform – however in some instances this will be a choice rather than an obligation (and other channels such as posting on the entity’s own website or direct notifications to affected stakeholders may be preferred). |
So, where to from here?
This space is undoubtedly one to watch as the listed entities begin to apply the updated guidance in a real-time data breach context.
While challenges still exist in managing disclosure obligations in a dynamic, ever-evolving data breach / cyber incident scenario – and listed entities should not be lulled into thinking the guidance provides a ‘step by step’ guide to disclosure – on the whole, this new guidance from ASX will be a welcome addition.
Key contacts
Legal Notice
The contents of this publication are for reference purposes only and may not be current as at the date of accessing this publication. They do not constitute legal advice and should not be relied upon as such. Specific legal advice about your specific circumstances should always be sought separately before taking any action based on this publication.
© Herbert Smith Freehills 2024