Later, SolarWinds suffered a breach of its network monitoring software, Orion, that allowed suspected Russian government-connected hackers to infiltrate thousands of customer organizations that included nine federal agencies. The breach began as early as 2019 but only became public in 2020. The Government Accountability Office called it “one of the most widespread and sophisticated hacking campaigns ever conducted against the federal government and private sector.”
“Dating back to at least October 2018, when SolarWinds conducted its [initial public offering] continuing through at least December 2020, SolarWinds and/or Brown made materially false and misleading statements and omissions related to SolarWinds securities risks and practices in at least three types of public disclosures,” the SEC complaint says.
In a briefing with reporters, the SEC said the complaint is not “Monday morning quarterbacking.” It said the company would have violated federal securities law even if the breach had not happened.
According to the SEC, Brown and others had received ample warning of vulnerabilities at SolarWinds but did not disclose those problems publicly. In one internal warning in September 2020, SolarWinds executives were told “the volume of security issues being identified over the last month have outstripped the capacity of engineering teams to resolve.” In another, in November of that year, a senior manager noted that, “We’re so far from being a security-minded company.” The warnings date back as far as 2018, according to the SEC.
The SEC said that SolarWinds also failed to disclose in December 2020 that attackers already had successfully exploited vulnerabilities against SolarWinds customers multiple times over the prior six months.
Because the SEC sent notices this summer to the company about a potential enforcement action, SolarWinds had already vowed to fight it.
“We disagree that any such action is warranted against either the company or any employees, and we will continue to explore a potential resolution of this matter before the SEC makes any final decision,” SolarWinds CEO Sudhakar Ramakrishna wrote in an internal email in June. “And if the SEC does ultimately decide to initiate any legal action, we intend to vigorously defend ourselves.”
In a statement released Monday, SolarWinds accused the SEC of “overreach” and described itself as “disappointed by the SEC’s unfounded charges related to a Russian cyberattack on an American company and are deeply concerned this action will put our national security at risk.”
