As Matt Levine likes to say, everything is Securities Fraud. Didn't disclose a risk factor in your SEC filings that your computer systems are potentially hackable? Well, a discovered vulnerability is Securities Fraud!

(Though, usually that's for a shareholder lawsuit instead of an SEC enforcement action)