SEC takes legal action against SolarWinds and security chief over undisclosed vulnerabilities

In recent developments, the Securities and Exchange Commission (SEC) has initiated legal proceedings against Texas-based technology firm SolarWinds and its top security official, Tim Brown, accusing them of fraudulent practices related to undisclosed cybersecurity weaknesses. These vulnerabilities were exploited in a significant 2020 cyberespionage operation attributed to Russian operatives, marking one of the most substantial cybersecurity breaches in recent memory.

The SEC’s enforcement division director, Gurbir S. Grewal, is leading the lawsuit against SolarWinds and Brown for concealing these cybersecurity vulnerabilities that culminated in a massive Russian supply-chain hack in 2020. This espionage campaign affected U.S. government officials, Microsoft (NASDAQ:) email users, and private entities such as most Fortune 500 companies serviced by SolarWinds.

The SEC alleges that SolarWinds and Brown failed to disclose known cybersecurity vulnerabilities that led to a significant breach of Orion, their network monitoring software. The breach affected thousands of customers, including nine federal agencies. The Government Accountability Office labeled it one of the most extensive hacking campaigns ever.

From their IPO in October 2018 through December 2020, SolarWinds allegedly made misleading statements about their securities risks and practices. Despite warnings about security issues dating back to 2018 and explicit internal warnings in September 2020 about security issues exceeding engineering teams’ capacity to resolve, SolarWinds did not publicly disclose them. In December 2020, they also failed to reveal that attackers had exploited vulnerabilities against their customers multiple times over the previous six months.

SolarWinds CEO Sudhakar Ramakrishna dismissed the SEC’s allegations in an internal email sent in June as “unfounded charges” and “overreach”. He expressed concerns about potential national security risks and indicated the company’s intent to explore a potential resolution.

The lawsuit demands civil penalties, the removal of the implicated executive, and reimbursement of “ill-gotten gains”, implying unlawful profits from these security flaws. This case underscores the urgent need for transparency in cybersecurity practices to prevent such devastating breaches.

This article was generated with the support of AI and reviewed by an editor. For more information see our T&C.