UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF GEORGIA ATLANTA DIVISION SECURITIES AND EXCHANGE COMMISSION Plaintiff v Case No SUDHAKAR REDDY BONTHU Defendant JURY TRIAL DEMANDED COMPLAINT Plaintiff Securities and Exchange Commission the “Commission” files its complaint and alleges that SUMMARY 1 Defendant Sudhakar Reddy Bonthu “Bonthu” committed securities fraud by engaging in illegal insider trading in the securities of Equifax Inc “Equifax” or “the company” Bonthu was an Equifax employee from September 2003 until March 2018 2 In late August 2017 after being entrusted by his employer with material nonpublic information about a massive cyber-intrusion and data breach purportedly suffered by an unnamed client of the company Bonthu deduced that Equifax was itself the victim of the breach Bonthu then traded against the company by purchasing risky put option contracts in Equifax common stock 3 On September 8 2017 the day after Equifax publicly announced that it had suffered a massive breach Bonthu sold all of his Equifax put options for total net proceeds of more than $75 000 4 By the conduct detailed in this Complaint Bonthu violated Section 10 b of the Securities Exchange Act of 1934 “Exchange Act” 15 U S C § 78j b and Rule 10b-5 17 C F R § 240 10b-5 thereunder Unless enjoined Bonthu is likely to commit such violations again in the future 5 The Commission seeks a judgment from the Court a enjoining Bonthu from engaging in future violations of the antifraud provisions of the federal securities laws and b ordering Bonthu to disgorge an amount equal to his illgotten gains resulting from the actions described herein with prejudgment interest JURISDICTION AND VENUE 6 The Commission brings this action pursuant to Section 21 d of the Exchange Act 15 U S C § 78u d 7 The Court has jurisdiction over this action pursuant to Sections 21 d 21 e 21A and 27 of the Exchange Act 15 U S C §§ 78u d 78u e 78u-1 and 78aa 2 8 Bonthu directly or indirectly used the means or instruments of interstate commerce the mails or the facilities of a national securities exchange in connection with the acts described herein 9 Venue is proper under Section 27 of the Exchange Act 15 U S C § 78aa and 28 U S C § 1391 because a substantial part of the events or omissions giving rise to the claims made herein occurred in the Northern District of Georgia In addition Bonthu currently resides in the Northern District of Georgia DEFENDANT 10 Sudhakar Reddy Bonthu age 44 is a resident of Cumming Georgia Bonthu is a citizen of India and a permanent resident of the United States He was an employee of Equifax from September 2003 until March 2018 Beginning in September 2013 he was a Production Development Manager of Software Engineering in Equifax’s Global Consumer Solutions “GCS” business unit On March 12 2018 his employment was terminated by Equifax Bonthu is currently unemployed RELEVANT ENTITY 11 Equifax Inc an information solutions and human resources company is a Georgia corporation headquartered in Atlanta Georgia Equifax’s common stock 3 trades on the New York Stock Exchange under the symbol “EFX ” Equifax is one of three major consumer credit bureaus STATEMENT OF FACTS I THE EQUIFAX CYBERSECURITY BREACH 12 On July 29 2017 Equifax’s security department observed suspicious network traffic within an internal system Over the next several weeks it was determined that Equifax had been subject to cyber-intrusions that resulted in a breach of Equifax’s information technology “IT” systems 13 A crisis action team consisting of Equifax security IT and legal personnel was formed and began working to analyze forensic data and determine the scope of the intrusion The analysis suggested it was likely that sensitive data including personally identifiable information “PII” for millions of consumers had been stolen 14 Equifax established a notification and remediation plan for the millions of consumers affected by the breach The company designated this effort as “Project Sparta ” 15 Although the crisis action team members were aware that Equifax had been breached the company made attempts to keep that information confidential from others To limit the number of people who knew that Equifax itself had been 4 breached the Equifax employees who were part of Project Sparta were told that they were working for an unnamed potential client that had experienced a large data breach 16 Project Sparta was handled largely through the company’s GCS unit which developed and sold various personal security and identity theft defense products and services to clients II BONTHU IS ENTRUSTED WITH INFORMATION ABOUT THE BREACH 17 On August 25 2017 Bonthu a software product development manager working in GCS was assigned to work on a “fast-breaking opportunity” for an unnamed potential client as a part of Project Sparta 18 Bonthu was told that the project was a high priority for the unnamed company and had a short deadline because the client intended to “go live” on September 6 2017 with the breach remediation applications designed by Equifax 19 Bonthu was tasked with primary responsibility for developing an online user interface into which consumers could input information to determine whether they had been impacted by the breach Bonthu was also responsible for creating an algorithm that would schedule consumers to return to Equifax’s website to register for identity protection tools 5 20 Between August 25 and August 31 2017 in connection with his work on Project Sparta Bonthu received emails and participated in conversations that informed him that the breach impacted at least 100 million consumers – the largest breach opportunity Equifax ever had handled 21 In the course of his work Bonthu also used test datasets that contained the same types of PII that had been impacted by the breach including first and last names addresses phone numbers dates of birth and social security numbers 22 On August 31 2017 Bonthu was copied on an email that attached a test dataset file that was named “EFXDatabreach postman_collection ” III BONTHU CONCLUDES THAT EQUIFAX WAS THE REAL VICTIM OF THE BREACH 23 By no later than August 31 2017 based on material nonpublic information entrusted to him by his employer Equifax Bonthu had concluded that Equifax itself was the victim of a major cybersecurity breach despite the statements made as part of Project Sparta asserting that it was a business opportunity for an unnamed client 24 Bonthu owed a duty of trust and confidence to Equifax and its shareholders not to trade on the basis of material nonpublic information that he learned through his employment with Equifax and was aware of his duty 6 25 Bonthu knew or was reckless in not knowing that the information that Equifax was the victim of a major cybersecurity breach was material 26 Bonthu knew or was reckless in not knowing that the information that Equifax was the victim of a major cybersecurity breach was nonpublic IV BONTHU’S TRADING IN EQUIFAX SECURITIES 27 On September 1 2017 Bonthu accessed his family’s brokerage accounts on their broker’s website 28 Bonthu had access to numerous family brokerage accounts several of which were held in his own name and had cash available for new transactions 29 From the available accounts however Bonthu chose an account held solely in his wife’s name 30 In his wife’s account Bonthu purchased eighty-six out-of-the-money put option contracts for shares of Equifax common stock with an expiration date of September 15 2017 and a strike price of $130 per share Bonthu made this purchase despite the fact that Equifax’s policies expressly prohibit any trading in derivative securities including put and call options 31 By purchasing out-of-the-money put options Bonthu could make money only if the market price of Equifax stock were to drop below the put option strike price before the contract expired approximately two weeks later on September 15 7 If the market price did not so drop the put options would expire and his investment would be worthless 32 The strike price of $130 per share was more than $10 below the price at which Equifax common stock traded on that day 33 The total price of the Equifax option contracts purchased by Bonthu on September 1 was $2 166 11 34 Bonthu had never previously traded in Equifax options V EQUIFAX TELLS THE PUBLIC ABOUT THE BREACH AND BONTHU SELLS HIS PUT OPTIONS 35 After the close of the market on September 7 2017 Equifax issued a press release and filed a Form 8-K with the Commission announcing the cybersecurity breach and revealing that it potentially impacted approximately 143 million consumers in the United States 36 The breach was one of the leading news stories over the next several days and was described as “one of the worst data breaches ever by its reach and by the kind of information exposed to the public ” 37 On September 8 the price of Equifax common stock closed at $123 23 a drop of $19 49 nearly 14% per share from the prior day’s closing price of $142 72 Trading volume that day also increased dramatically to nearly seventeen 8 million shares more than a thirty-fold increase from the previous day’s volume of approximately 518 000 shares 38 Also on the morning of September 8 and despite Equifax’s policies expressly forbidding transactions in derivative securities Bonthu sold all of his Equifax put option contracts As a result of the precipitous drop in Equifax’s share price Bonthu turned his initial investment of $2 166 11 into $77 333 79 in only six days In sum Bonthu’s ill-gotten gains from his trading in Equifax options totaled $75 167 68 a return of more than 3 500% on his initial investment 39 Bonthu’s securities transactions were made on the basis of material nonpublic information and breached the duty of trust and confidence that he owed to Equifax and its shareholders Bonthu knew or was reckless in not knowing that the information that Equifax itself was the victim of a major cybersecurity breach was material and nonpublic and Bonthu used that information when making these securities transactions 40 Bonthu’s trading on the basis of material nonpublic information entrusted to him by Equifax was deceptive and fraudulent 9 VI EQUIFAX TERMINATES BONTHU’S EMPLOYMENT 41 On March 12 2018 following Bonthu’s refusal to cooperate with an internal investigation into whether he had violated the company’s insider trading policy Bonthu’s employment at Equifax was terminated COUNT I – INSIDER TRADING IN CONNECTION WITH THE PURCHASE OR SALE OF SECURITIES Violations of Section 10 b of the Exchange Act and Rule 10b-5 Thereunder 15 U S C § 78j b 17 C F R § 240 10b-5 42 The Commission realleges and reincorporates paragraphs 1 through 41 as if fully set forth herein 43 Bonthu with scienter by use of the means or instrumentalities of interstate commerce or of the mails in connection with the purchase or sale of securities a employed devices schemes or artifices to defraud b made untrue statements of material fact or omissions to state material facts necessary in order to make the statements made in light of the circumstances under which they were made not misleading and or c engaged in acts practices or courses of business which operated or would operate as a fraud or deceit 44 By reason of the actions alleged herein Bonthu violated Section 10 b of the Exchange Act 15 U S C § 78j b and Rule 10b-5 thereunder 17 C F R § 240 10b-5 10 PRAYER FOR RELIEF WHEREFORE the Commission respectfully requests that the Court enter a judgment i finding that Bonthu violated the antifraud provisions of the federal securities laws as alleged herein ii permanently enjoining Bonthu from violating Section 10 b of the Exchange Act 15 U S C § 78j b and Rule 10b-5 thereunder 17 C F R § 240 10b-5 iii ordering Bonthu to disgorge an amount equal to his ill-gotten gains resulting from the actions alleged herein and to pay prejudgment interest thereon and iv granting such other relief as this Court may deem just and proper DEMAND FOR JURY TRIAL Pursuant to Rule 38 of the Federal Rules of Civil Procedure the Commission demands trial by jury in this action of all issues so triable Dated this 28th day of June 2018 11 Respectfully submitted s M Graham Loomis M Graham Loomis Regional Trial Counsel Georgia Bar No 457868 Tel 404 842-7622 Email loomism@sec gov W Shawn Murnahan Senior Trial Counsel Georgia Bar No 529940 Tel 404 842-7669 Email murnahanw@sec gov COUNSEL FOR PLAINTIFF Securities and Exchange Commission Atlanta Regional Office 950 East Paces Ferry Road N E Suite 900 Atlanta GA 30326-1382 Tel main 404 842-7600 Fax 703 813-9364 12