The SEC's Division of Enforcement recently issued voluntary
information requests to several public companies, inquiring about
the details of any impact arising from the widely publicized
December 2020 SolarWinds cyberattack. These requests — sent
to several public companies that had used SolarWinds' software,
as well as funds, investment advisors, and other entities —
were delivered via the SEC's mail service for delivery of
encrypted messages in connection with confidential investigations.
The requests, identified initially by some companies as spam or
phishing emails, now in large part have been confirmed as
legitimate.
In most instances, the recipients received a week from the date
of delivery to respond, indicating whether the company intends to
provide the requested information. If the recipient elects to
respond, the company has one week from that date of receipt to
substantively respond to the request. In many cases, those
deadlines have been as early as June
