Not Just A Cyber Attack: Evolving Issues For Director And Officer Liability In The US And Canada

Is guarding against the modern risk of a cyber-attack part of the due diligence expected of a diligent and prudent officer and director?

Can directors and management of a company be personally liable for a cybersecurity attack on their watch? Recent charges filed by the U.S. Securities and Exchange Commission ("SEC") against a company and its Chief Information Security Officer ("CISO") suggest that that the answer may be "yes".

In October 2023, the SEC filed civil charges against SolarWinds Corporation ("SolarWinds"), a US company providing IT service management software, as well as its CISO for fraud and internal control failures relating to a 2020 cyberattack. This marks the first time the SEC has brought charges against a company's CISO in connection with a cybersecurity incident. In its complaint, the SEC alleged that SolarWinds and the CISO misled their investors about the company's cybersecurity practices, failed to disclose known risks, and inadequately