SEC Charges Four Firms Over Misleading SolarWinds Attack Claims

SEC Charges Four Companies Over Misleading Cybersecurity Disclosures Related to SolarWinds Hack

The U.S. Securities and Exchange Commission (SEC) has taken significant action by charging four public companies—Avaya, Check Point, Mimecast, and Unisys—for making "materially misleading disclosures" following the notorious SolarWinds cyberattack in 2020. This incident, which involved a large-scale breach of the SolarWinds Orion software supply chain, has raised serious concerns about corporate transparency in the face of cybersecurity threats.

These companies are being penalized for downplaying the severity of the breach and failing to adequately inform investors, which violates the Securities Act of 1933 and the Securities Exchange Act of 1934. The SEC’s findings underscore the critical importance of accurate disclosures in maintaining investor trust and market integrity.

Financial Penalties for Misleading Disclosures

As a result of the SEC’s investigation, each company has agreed to financial settlements for their misleading disclosures:

  • Avaya: $1 million fine
  • Check Point: $995,000 fine
  • Mimecast: $990,000 fine
  • Unisys: $4 million fine, with additional charges for violations of disclosure controls and procedures

SEC’s Stance on Cybersecurity Accountability

Sanjay Wadhwa, acting director of the SEC’s Division of Enforcement, emphasized that while public companies are often targets of cyberattacks, they have a responsibility to their shareholders and the investing public. “Misleading disclosures about cybersecurity incidents not only obscure the truth but also leave investors in the dark,” he stated.

The SEC’s investigation revealed that all four companies were aware that Russian threat actors had unlawfully accessed their systems yet chose to minimize the incident’s scope in their public disclosures. Notably, Unisys referred to the risks posed by the breach as "hypothetical," despite evidence that over 33 GB of data had been exfiltrated during the attacks.

Specific Findings Against Each Company

  • Avaya: Misrepresented the extent of the breach, claiming only a "limited number" of email messages were accessed, while attackers accessed at least 145 files from its cloud environment.
  • Check Point and Mimecast: Both companies framed the risks broadly and failed to disclose critical details about the nature of the exfiltrated code and the number of encrypted credentials compromised.

Implications for Public Companies

The SEC’s actions serve as a warning to all public companies about their obligations under federal securities laws. “The federal securities laws prohibit half-truths, and there is no exception for statements in risk-factor disclosures,” stated Jorge G. Tenreiro, acting chief of the Crypto Assets and Cyber Unit.

As the cybersecurity landscape evolves, companies must prioritize transparency and accuracy in their disclosures to protect investors and maintain compliance with regulatory standards.

Conclusion

The SEC’s enforcement actions against Avaya, Check Point, Mimecast, and Unisys highlight the critical intersection of cybersecurity and corporate governance. Companies must recognize the importance of providing clear and truthful information about cybersecurity incidents, fostering trust with their investors and the public.

If you found this article insightful, feel free to share your thoughts in the comments below or explore more articles on cybersecurity and corporate governance on our website. Follow us on Twitter and LinkedIn for the latest updates and exclusive content.

Best deals on Microsoft Office
Share it

Similar Posts

New Advanced Zloader Malware Variant Discovered

New Infostealer ‘PLAYFULGHOST’ Detected

A new malware called PLAYFULGHOST poses a serious cybersecurity threat, using phishing and SEO poisoning tactics to steal user data. It mimics the notorious Gh0st RAT tool, employing deceptive phishing emails that lead users to open malicious files and manipulate search results to trick users into downloading harmful software. PLAYFULGHOST can log keystrokes, capture screenshots and audio, and gather sensitive information. It also utilizes advanced techniques to maintain persistence on infected devices and can erase data from applications. Users are advised to verify email sources, update security software, and stay informed about phishing tactics to protect themselves.

Chinese Hackers Exploit VSCode Remote Tunnels for Espionage

Chinese Hackers Target US Office Reviewing Foreign Investments

Chinese hackers breached the U.S. Treasury Department, targeting the Committee on Foreign Investment in the U.S. (CFIUS), which reviews foreign investments posing national security risks. This incident raises alarm over escalating cyberattacks from China, emphasizing the need for improved cybersecurity in critical government sectors. Experts highlight concerns about espionage tied to land acquisitions near military bases and urge immediate action, including passwordless multi-factor authentication and micro-segmentation of networks. The breach reflects broader U.S.-China tensions and indicates that organizations with valuable information should prepare for increased cyber threats, underscoring the urgency for enhanced cybersecurity measures.

Why Security Leaders Struggle to Secure Funding

Exploits of Critical Fortinet EMS Bug Continue

A critical SQL injection vulnerability (CVE-2023-48788) in Fortinet FortiClient EMS is posing a global threat, affecting organizations in multiple countries, including Brazil, France, and India. Cybercriminals exploit this vulnerability to gain unauthorized access and control over exposed Windows systems. Kaspersky reports that attackers have used tools like ScreenConnect and Mimikatz for credential theft and data gathering. The increasing complexity of these attacks emphasizes the need for enhanced security measures, including regular software updates, intrusion detection systems, and employee training on cybersecurity practices. Organizations are urged to stay informed and proactive to mitigate risks associated with this vulnerability.

AI Ransomware FunkSec Hits 85 Victims with Double Extortion

AI Ransomware FunkSec Hits 85 Victims with Double Extortion

In late 2024, researchers identified a new ransomware family called FunkSec, which has targeted over 85 victims globally. This group employs a ransomware-as-a-service model, attracting novice cybercriminals. FunkSec launched a data leak site to centralize its operations, offering tools for DDoS attacks and showcasing a troubling mix of hacktivism and organized cybercrime. Key figures in the group include individuals from Algeria and Indonesia, promoting political motives alongside financial gains. Their advanced ransomware, FunkSec V1.5, features capabilities like recursive encryption and privilege escalation. Cybersecurity experts warn of the blurred lines between hacktivism and cybercrime as threats evolve.

Two Organizations Navigate the Cyber Insurance Maze

Two Organizations Navigate the Cyber Insurance Maze

In the current digital environment, many businesses need cybersecurity insurance, often unaware that implementing specific security measures can lower premiums. Strategies like Multi-Factor Authentication (MFA), robust vulnerability management, and Managed Detection and Response (MDR) services can lead to significant savings. As ransomware incidents rise, insurance providers are increasing premiums and imposing stricter requirements. MDR, which offers 24/7 threat detection and proactive responses, can reduce premiums by up to 33%. Case studies show organizations, such as a North Carolina non-profit, saving thousands annually by integrating MDR with their cybersecurity strategy, enhancing security and reducing costs.

Updated Mirai Botnet Targets Vulnerable Devices in Ongoing Attacks

Updated Mirai Botnet Targets Vulnerable Devices in Ongoing Attacks

A new Mirai-based botnet is targeting vulnerable routers and devices, particularly Teltonika RUT9XX and TP-Link, exploiting known vulnerabilities like CVE-2018-17532 and CVE-2023-1389. This campaign, which began in September, poses a risk of large-scale DDoS attacks. The advanced botnet features multi-platform support and enhanced encryption methods, such as ChaCha20. Recent attacks have successfully executed command injections on DigiEver DS-2105 Pro network video recorders, allowing the deployment of the botnet. Cybersecurity experts recommend updating firmware, changing default credentials, and monitoring network traffic to protect against these threats. Staying informed is essential as cyber threats continue to evolve.

Leave a Reply

Your email address will not be published. Required fields are marked *