SolarWinds says it’s facing SEC ‘enforcement action’ over 2020 hack

The long hangover from a 2020 state-sponsored compromise still isn’t over for SolarWinds, as the software giant targeted by Russian government hackers has to pony up $26 million to shareholders and face possible enforcement action from the federal government.

In a recent 8-K filing with the U.S. Securities and Exchange Commission, SolarWinds said it reached an agreement with shareholders, who sued the company alleging they were misled about the 2020 hack. Investors accused the software house, which makes network management tools used by corporations and government departments, of misrepresenting its security and failing to adequately monitor cybersecurity risks. SolarWinds will not accept any liability or admit fault as part of the shareholder suit, if a court agrees to the settlement.

SolarWinds was initially hacked as far back as in 2019 by hackers associated with Russia’s foreign intelligence service, who broke in to the company’s network and planted a backdoor in the company’s flagship Orion network management product, which when pushed as a tainted software updates to customers, allowing the Russian hackers to further access the networks of every network running the compromised SolarWinds software. News of the attack began to emerge a year later in late 2020.

Several government departments, including NASA, the Justice Department and Homeland Security, were compromised by the mass breach, with the bulk of victims including private companies, like security giant FireEye, Fortune 500 companies, and hospitals and universities.

The U.S. government later attributed the hack to the Russian government as part of a long-running espionage campaign.

In the same filing, SolarWinds also said it received a Wells notice from the SEC, informing the company of the regulator’s intention to file enforcement action “with respect to its cybersecurity disclosures and public statements, as well as its internal controls and disclosure controls and procedures.” SolarWinds said its disclosures and public statements at the time of the breach were “appropriate,” but did not elaborate.

The SEC began investigating the SolarWinds breach in 2021, including whether some companies failed to disclose that they were affected by the breach and allegations of possible insider trading, according to The Washington Post.

Spokespeople for the SEC, which does not comment on its investigations, and SolarWinds, did not respond to a request for comment.