WMHW Alert: SEC Charges Four Companies Over SolarWinds Hack Cyber Disclosures

On October 22, 2024, the Securities and Exchange Commission ("SEC") charged four technology companies with making inadequate disclosures related to the December 2020 discovery that SolarWinds Corp. had been a victim of a largescale cyberattack believed to have been conducted by state-sponsored Russian hackers. According to the SEC's October 22, 2024 press release, during 2020 and 2021, these four companies learned "that the threat actor likely behind the SolarWinds Orion hack had accessed their systems without authorization, but each negligently minimized its cybersecurity incident in its public disclosures." ¹ The SEC's cases, charging violations of Sections 17(a)(2) and 17(a)(3) of the Securities Act, Section 13(a) of the Exchange Act, and Rules 12b-20 and 13a-13 thereunder, are the first against users of the impacted SolarWinds product. They represent a somewhat controversial set of enforcement actions in the SEC's rocky response to the SolarWinds hack.