Proposed Deal Could End Precedent-Setting SEC Case Over Cybersecurity Misstatements
The U.S. Securities and Exchange Commission and SolarWinds agreed to settle a landmark cyberfraud lawsuit following a change of control in the regulatory agency.
See Also: Beyond Replication & Versioning: Securing S3 Data in the Face of Advanced Ransomware Attacks
The proposed settlement must now be reviewed and approved by the full commission, which has been under Republican control since January. Judge Paul Engelmayer directed the SEC and SolarWinds to file a joint status report by Sept. 12 if final settlement paperwork hasn’t been submitted by then. The oral argument organically scheduled for July 22 has been stayed because of this settlement development.
“The court congratulates counsel and the parties on this productive development,” Engelmayer wrote Wednesday in an order on the motion to stay. “The court stays all pending filing deadlines and adjourns the oral arguments.”
How the SEC and SolarWinds Reached This Point
The SEC’s lawsuit, which dates back to October 2023, centers on allegations that SolarWinds and its executives misrepresented their cybersecurity posture in statements made between 2018 and 2020. Engelmayer dismissed most of the lawsuit in July 2024, but allowed one claim to proceed focused on an allegedly misleading security statement made just prior to the December 2020 Orion hack disclosure (see: Judge Dismisses Most SEC Fraud Claims Against SolarWinds).
Specifically, Engelmayer said a jury could reasonably find SolarWinds’ pre-breach security statement misleading since it boasted of access controls and password policies that internal records contradicted. Brown’s internal acknowledgment of those deficiencies while simultaneously allowing the misleading statement to remain online could meet the threshold for “highly unreasonable or extreme misconduct.”
“Brown knew of the substantial body of data that impeached the Security Statement’s content as false and misleading,” Engelmayer wrote in July 2024. “His conduct in allowing the statement to issue publicly, and to remain in place for years, in the face of company practices inconsistent with it, is plausibly plead as ‘highly unreasonable or extreme misconduct.'”
The two sides tried to reach a settlement after Engelmayer’s ruling, but the legal counsel for SolarWinds and Brown said they were unlikely to accept the SEC’s offer and suggested that a third-party mediator intervene. But the talks fizzled, and the SEC sought oral testimony from a former SolarWinds engineer who documented concerns over a network vulnerability tied to VPN access and unmanaged devices (see: SEC Moves to Get Foreign Testimony in SolarWinds Fraud Case).
Specifically, former engineer Robert Krajcir raised red flags related to how anyone with Active Directory credentials could connect through VPN using unmanaged devices. The SEC said Krajcir’s testimony is vital because no other witness has his specific technical visibility into the VPN and network architecture at the time. But Krajcir declined to testify voluntarily, prompting the SEC to seek judicial assistance.
How the Deal Reflects Changing Political Tides at the SEC
Regulators sought significant penalties through litigation, including barring CISO Tim Brown from serving as a public company officer and the forfeiture of any alleged ill-gotten gains. But the SEC commissioners shifted in January from being mostly appointed by Democrats to being mostly appointed by Republicans, and the two Republican commissioners who served under former President Joe Biden disagreed with the prior approach.
Commissioners Hester Peirce and Mark Uyeda dissented in 2024 when the three Democratic-appointed commissioners forced Check Point and Mimecast to each pay $1 million to settle charges of making materially misleading disclosures related to the Orion hack. “Donning a Monday morning quarterback’s jersey to insist that immaterial information be disclosed does not protect investors,” they said last year (see: Check Point, Mimecast Settle SEC Case From SolarWinds Hack).
The SEC under Biden used cybersecurity mismanagement as the basis for securities fraud charges, which was the first time the agency filed an accounting controls claim rooted in cybersecurity practices. President Trump appointed Uyeda acting chairman of the SEC in January, and now Peirce and Uyeda, part of a GOP majority on the commission, appear skeptical of this precedent-setting move, suggesting the SEC was unfairly second-guessing companies with hindsight.
“Cybersecurity incidents are one of a myriad of issues that most companies face,” the two commissioners wrote in October. “The Commission needs to start treating companies subject to cyberattacks as victims of a crime, rather than perpetrators of one.”
While some internal shortcomings were acknowledged, lawyers for SolarWinds argued they do not rise to the level of intentional fraud. Instead, they maintain that the SEC is unfairly holding them responsible for industry-wide challenges in cybersecurity rather than fraudulent misrepresentations. Flaws found by the SEC were either addressed over time or were not severe enough to warrant investor disclosures.
As political tides shift, both the SEC and SolarWinds recognize the uncertainty of jury interpretation in a precedent-setting case. The SEC gets accountability and reputational impact without risking a potential trial loss in a legally gray area, while SolarWinds and Brown avoid the reputational and financial toll of a prolonged trial. The lack of clear legal precedent in this area provides fertile ground for compromise.