SEC Drops Civil Fraud Lawsuit Against SolarWinds and Its CISO
The U.S. Securities and Exchange Commission (SEC) announced on Thursday that it is dropping its civil fraud lawsuit against SolarWinds and its Chief Information Security Officer, Tim Brown. The case involved a supply-chain attack launched by Russian hackers in 2020 through the Orion software, and the SEC had accused the company of failing to disclose known security risks. The dismissal was made with prejudice, but the SEC stated that it does not affect other cases. SolarWinds welcomed the decision, stating that its team acted appropriately.
The U.S. Securities and Exchange Commission (SEC) announced on Thursday thatit is dropping its landmark civil fraud lawsuit against SolarWinds and its Chief Information Security Officer, Tim Brown。
The SEC sued SolarWinds in 2023, alleging that the company failed to disclose known security risks to investors in the lead-up to a major supply chain attack in 2020, in which Russian government hackers embedded malicious software into the company's Orion software.
The SEC's lawsuit alleged that SolarWinds and Brown were aware of specific deficiencies in the company's cybersecurity program,but never informed investors. In the complaint, the agency accused the company and Brown of fraud and internal control failures.
However, on Thursday, the SEC and the defendants jointlyfiled a joint stipulation to dismiss the case with prejudice. The SEC stated that this dismissal does not necessarily have any impact on other cases.
Numerous government agencies and commercial enterprises use SolarWinds' Orion platform, which allowed Russia to gain broad access to the company's customer systems after infiltrating client networks through compromised code.
The SEC's lawsuit against SolarWinds suffered a major setback in 2024 when a federal judgedismissed most of the claims, including all allegations related to events following the disclosure of the attack in December 2020, as well as charges related to internal accounting and disclosure controls.
SolarWinds said it is "obviously pleased" with the SEC's decision to abandon the lawsuit, which the company called an overreach by the SEC.
"We fought with conviction, believing the facts showed our team acted appropriately, and this outcome is a strong validation of our position," a SolarWinds spokesperson said in an interview with Cybersecurity Dive, a sister publication of CFO Dive. "We hope this resolution alleviates the concerns many CISOs have expressed about this case and the chilling effect it could have on their work."
The SEC declined to comment beyond its court filings and the press release related to this case.