SolarWinds Misled Public on Cyber Risk Before Hack, SEC Claims

The Securities and Exchange Commission alleged on Monday that SolarWinds Corp. defrauded investors by downplaying security risks ahead of a hack of its software that rippled through computer systems across the US government and corporate America.

On Monday, the SEC accused SolarWinds Corp. of deceiving investors. (REUTERS)

The Securities and Exchange Commission alleged on Monday that SolarWinds Corp. defrauded investors by downplaying security risks ahead of a hack of its software that rippled through computer systems across the US government and corporate America.

The SEC also accused the top information security official at SolarWinds, Tim Brown, of breaking securities rules in a lawsuit filed in federal court in Manhattan. The action is the first time the regulator has sued a computer security executive for a cybersecurity-related issue. 

The SolarWinds hack was among the worst cyber breaches in history, affecting hundreds of public companies and numerous government agencies. The motives behind the breach remain unclear. The US blamed Russia and sanctioned dozens of entities and officials for the hack. Russia denied any involvement.

The attackers installed malicious code in updates for popular software from SolarWinds, which was widely used by the government and corporations. The SEC alleged that SolarWinds and Brown were warned of weak cybersecurity within the company but that they painted a far rosier picture to investors. 

Texas-based SolarWinds is exploring options including a potential sale, people familiar with the matter said last week.