SEC Reaches Settlement With SolarWinds Over Sunburst Breach (1)

The Securities and Exchange Commission has reached a settlement with SolarWinds Inc. over the company’s alleged failure to disclose cybersecurity risks prior to its 2020 announcement that it had been the target of a two-yearlong cyberattack.

The parties filed Wednesday a joint motion to stay all pending dates in the SEC’s lawsuit against the company in light of the settlement in principle, according to a settlement letter filed in the US District Court for the Southern District of New York.

Judge Paul A. Engelmayer had previously scheduled a hearing on SolarWinds’ motion for summary judgment for July 22, a year after the judge dismissed most of the SEC’s lawsuit alleging the software provider misled investors about its cybersecurity practices, and the significance of a major data breach that spilled into the US government.

That ruling was seen as a blow to the SEC’s aggressive efforts to regulate the cybersecurity practices of publicly traded companies, actions that had created anxiety among the private sector and security practitioners.

Russian hackers breached SolarWinds by inserting malicious code into a software update that was sent to its customers. The hackers then used the malware as a backdoor for intrusions targeting dozens of companies and at least nine government agencies. The breach was revealed in December 2020.

The SEC’s lawsuit against SolarWinds struck a chord in the cyber industry in part because of the decision to bring claims against the company’s security chief, Timothy Brown, as an individual. Engelmayer dismissed some claims against Brown in the July 2024 ruling.

Among the claims dismissed from the SEC’s lawsuit was a charge that SolarWinds violated internal accounting control rules in connection with the hack.

The accounting rules require companies to accurately report financial transactions and events, but the SEC’s attempt to apply the rules to password policies and other cybersecurity rules wasn’t tenable, Engelmayer said.

The judge allowed some of the claims against SolarWinds and Brown to proceed, including that the company and Brown committed securities fraud with a statement about the company’s preparations against cyberattacks.

Latham & Watkins LLP represents SolarWinds and Brown.

The case is Sec. and Exch. Comm’n v. SolarWinds Corp., S.D.N.Y., No. 1:23-cv-09518, motion filed 7/2/25.