SEC voluntarily dismisses SolarWinds lawsuit

The Securities and Exchange Commission says it is voluntarily dismissing a 2023 lawsuit charging that SolarWinds Corp. and its chief information security officer defrauded investors by not warning them about shoddy cybersecurity practices.

The agency announced the decision on Thursday but declined to comment other than to say it did so “in the exercise of its discretion.”

A spokesperson for SolarWinds said in a statement that the company is “clearly delighted.”

“We fought with conviction, arguing that the facts demonstrated our team acted appropriately — this outcome is a welcome vindication of that position,” the statement said. “We hope this resolution eases the concerns many CISOs have voiced about this case and the potential chilling effect it threatened to impose on their work.”

Thursday's decision follows a July 2024 court ruling in which a federal judge dismissed most of the SEC’s case, saying its charges against SolarWinds “impermissibly rely on hindsight and speculation.”

The lawsuit had alleged that SolarWinds misled investors by sharing only generic and hypothetical risks even as the company and its CISO Timothy Brown knew about specific problems with its cybersecurity practices and the heightened risks the company faced.

The case focused on the company and Brown’s actions before and after an almost two-year-long cyberattack, discovered in 2020, in which Russian hackers placed malware in a SolarWinds’ monitoring application.

From there, Russian operatives were able to infiltrate several large companies and federal government agencies, including the departments of Defense, Homeland Security and Justice.

At the end of the Biden administration, four companies were fined by the SEC for lackluster disclosures related to the SolarWinds incident.