Judge dismisses much of SEC suit against SolarWinds over cybersecurity disclosures

The groundbreaking lawsuit’s claims about inadequate disclosures related to the historic Sunburst attack were thrown out Thursday.

A U.S. judge on Thursday dismissed most of a Securities and Exchange Commission lawsuit against SolarWinds and a company official over allegations that it misled investors about the security of its Orion software, which accused Russian hackers exploited to conduct one of the most audacious cyberattack campaigns ever.

District Court Judge Paul Engelmayer threw out claims that SolarWinds didn’t adequately disclose the Sunburst attack that began in 2019 and was discovered in 2020. 

“These do not plausibly plead actionable deficiencies in the company’s reporting of the cybersecurity hack,” Engelmayer wrote. “They impermissibly rely on hindsight and speculation.”

He sustained claims of securities fraud related to one of SolarWinds’ pre-Sunburst statements about Orion security, but dismissed other SEC claims about separate company cybersecurity assertions.

The SolarWinds breach ultimately led to hackers, whom the U.S. government said were tied to the Russian government, infiltrating at least nine federal agencies and hundreds of companies.

The SEC brought its groundbreaking suit in October against SolarWinds and its former chief information security officer, Tim Brown, in what was widely seen as a message that the commission would hold executives accountable for known security failures.

Engelmayer’s ruling is largely a victory for industry officials who have said the charges would create a chilling effect in the field that would make individuals less likely to probe for vulnerabilities if they could later face legal ramifications.

A SolarWinds spokesperson said in an email that the company is “pleased that Judge Engelmayer has largely granted our motion to dismiss the SEC’s claims. We look forward to the next stage, where we will have the opportunity for the first time to present our own evidence and to demonstrate why the remaining claim is factually inaccurate. We are also grateful for the support we have received thus far across the industry, from our customers, from cybersecurity professionals, and from veteran government officials who echoed our concerns, with which the court agreed.”

An SEC spokesperson declined to comment.

You can read the full opinion here. 

This story was updated July 18, 2024, with SolarWinds and SEC responses to requests for comment.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure