In an unprecedented legal event, the US Securities and Exchange Commission (SEC) filed a case against SolarWinds and its Chief Information Security Officer (CISO) on October 30, 2023. The charges are hefty, detailing allegations of fraud, false reporting, and violations of internal and disclosure control policies. These accusations are in direct relation to the SUNBURST cyberattack that massively impacted SolarWinds.
The SEC generally seeks to negotiate settlements with alleged violators before they resort to legal proceedings. However, attempts at reaching a compromise with SolarWinds and its CISO following the Commission’s thorough enforcement investigation unfortunately fell through. Consequently, the SEC had no alternative but to file a litigated action against them.
The litigation comes on the heels of a massive SUNBURST cyberattack, which breached the firewall of several organizations, causing substantial harm to their operations and reputation.
Should the SEC be successful in its charges, this will set a precedent for future cases where companies and their officers fail to adhere to the proper legal guidelines and ethical conduct expected of them, particularly in managing data security issues.
More on the details of the SEC case against SolarWinds can be read in a recent post by Katten Muchin Rosenman LLP.