SEC v. Ashford Inc., No. LR-26215, Northern District of Texas (Jan. 13, 2025) — Press Release

U.S. SECURITIES AND EXCHANGE COMMISSION Litigation Release No. 26215 / January 13, 2025 Securities and Exchange Commission v. Ashford Inc., No. 3:25-cv-00082 (N.D. Tex. filed Jan. 13, 2025) Ashford Inc. To Settle Negligence-Based Charges for Misleading Investors Regarding a Cyber Incident The Securities and Exchange Commission filed settled charges against Ashford Inc. for materially false and misleading disclosures to investors regarding a cyber incident. Ashford, a formerly registered issuer based in Dallas, Texas, is an alternative asset management company with a portfolio of strategic operating businesses that provides global asset management, investment management, and related services to the real estate and hospitality sectors. According to the SEC’s complaint, Ashford learned in September 2023 that it had been subjected to a cybersecurity attack and ransomware demand by a foreign-based threat actor. As part of the attack the threat actor gained access to Ashford’s servers and exfiltrated more than 12 terabytes of data which was stored on Ashford’s internal computer systems and which contained, among other things, sensitive hotel guest information. In a quarterly report filed with the SEC in November 2023, Ashford indicated that it had “completed an investigation” and had “not identified that any customer information was exposed.” Ashford made similar disclosures in two additional quarterly reports, along with Ashford’s annual report filed with the SEC for the period ended December 31, 2023. However, Ashford knew or should have known that the exfiltrated data contained sensitive personally identifiable information and financial information related to guests. The SEC's complaint, filed in the U.S. District Court for the Northern District of Texas, charges Ashford with violating Section 17(a)(3) of the Securities Act of 1933 and Section 13(a) of the Exchange Act of 1934 and Rules 12b-20, 13a-1, and 13a-13 thereunder. Without admitting or denying the SEC's allegations, Ashford agreed to settle the SEC’s charges, consenting to an injunction and an order to pay a civil penalty of $115,231, which takes into account Ashford’s assistance to the SEC staff in its investigation. The settlement is subject to court approval. The SEC's investigation was conducted by Derek Kleinmann of the Fort Worth Regional Office and Arsen Ablaev of the SEC’s Crypto Assets and Cyber Unit and was supervised by Kristin Pauley and Jorge Tenreiro. The SEC’s litigation will be led by Patrick Disbennett and supervised by Keefe Bernstein of the Fort Worth Regional Office.

U.S. SECURITIES AND EXCHANGE COMMISSION Litigation Release No. 26215 / January 13, 2025 Securities and Exchange Commission v. Ashford Inc., No. 3:25-cv-00082 (N.D. Tex. filed Jan. 13, 2025) Ashford Inc. To Settle Negligence-Based Charges for Misleading Investors Regarding a Cyber Incident The Securities and Exchange Commission filed settled charges against Ashford Inc. for materially false and misleading disclosures to investors regarding a cyber incident. Ashford, a formerly registered issuer based in Dallas, Texas, is an alternative asset management company with a portfolio of strategic operating businesses that provides global asset management, investment management, and related services to the real estate and hospitality sectors. According to the SEC’s complaint, Ashford learned in September 2023 that it had been subjected to a cybersecurity attack and ransomware demand by a foreign-based threat actor. As part of the attack the threat actor gained access to Ashford’s servers and exfiltrated more than 12 terabytes of data which was stored on Ashford’s internal computer systems and which contained, among other things, sensitive hotel guest information. In a quarterly report filed with the SEC in November 2023, Ashford indicated that it had “completed an investigation” and had “not identified that any customer information was exposed.” Ashford made similar disclosures in two additional quarterly reports, along with Ashford’s annual report filed with the SEC for the period ended December 31, 2023. However, Ashford knew or should have known that the exfiltrated data contained sensitive personally identifiable information and financial information related to guests. The SEC's complaint, filed in the U.S. District Court for the Northern District of Texas, charges Ashford with violating Section 17(a)(3) of the Securities Act of 1933 and Section 13(a) of the Exchange Act of 1934 and Rules 12b-20, 13a-1, and 13a-13 thereunder. Without admitting or denying the SEC's allegations, Ashford agreed to settle the SEC’s charges, consenting to an injunction and an order to pay a civil penalty of $115,231, which takes into account Ashford’s assistance to the SEC staff in its investigation. The settlement is subject to court approval. The SEC's investigation was conducted by Derek Kleinmann of the Fort Worth Regional Office and Arsen Ablaev of the SEC’s Crypto Assets and Cyber Unit and was supervised by Kristin Pauley and Jorge Tenreiro. The SEC’s litigation will be led by Patrick Disbennett and supervised by Keefe Bernstein of the Fort Worth Regional Office.