SolarWinds says it faces SEC ‘enforcement action’ over 2020 hack
The long hangover from a 2020 government-sponsored compromise still isn’t over for SolarWinds, as the software giant targeted by Russian government hackers must raise $26 million for shareholders and face possible enforcement action from the federal government.
In a recent 8-K filing with the US Securities and Exchange Commission, SolarWinds said it reached an agreement with shareholders, who sued the company alleging they were misled about the 2020 hack. Investors accused the software house, which makes network management tools used by companies and government departments, to misrepresent security and fail to adequately monitor cyber security risks. SolarWinds will not accept any liability or admit wrongdoing as part of the shareholder lawsuit, if a court accepts the settlement.
SolarWinds was originally hacked as far back as 2019 by hackers affiliated with Russia’s foreign intelligence service, who broke into the company’s network and planted a backdoor in the company’s flagship Orion network management product, which when pushed as a tainted software update to customers, that allows Russian hackers gain additional access to the networks of any network running the compromised SolarWinds software. News of the attack began to emerge a year later in late 2020.
Several government departments, including NASA, the Department of Justice, and Homeland Security, were compromised by the mass breach, with the bulk of victims including private companies, such as security giant FireEye, Fortune 500 companies, and hospitals and universities.
The US government later attributed the hack to the Russian government as part of a long-running espionage campaign.
In the same filing, SolarWinds also said it received a Wells notice from the SEC, informing the company of the regulator’s intention to file enforcement actions “with respect to cybersecurity disclosures and public statements, as well as internal controls and disclosure controls and procedures.” SolarWinds said its disclosures and public statements at the time of the breach were “appropriate,” but did not elaborate.
The SEC began investigating the SolarWinds breach in 2021, including whether some companies failed to disclose they were affected by the breach and allegations of possible insider trading, according to The Washington Post.
Spokesmen for the SEC, which does not comment on investigations, and SolarWinds did not respond to a request for comment.
