The Securities and Exchange Commission (SEC) announced on Tuesday that it charged and imposed penalties on four companies for making misleading disclosures linked to the 2019 SolarWinds data breach.
The four companies charged are cybersecurity firms Check Point, which will pay a civil penalty of $995,000, and Mimecast, which will pay $990,000; and the tech companies Unisys, which will pay $4 million, and Avaya, which will pay $1 million.
All of these companies were victims of the hack that hit SolarWinds, which affected several other companies and government agencies that used SolarWinds software. According to the SEC, each company committed different violations that “negligently” downplayed and minimized the damage of the breaches.
“While public companies may become targets of cyberattacks, it is incumbent upon them to not further victimize their shareholders or other members of the investing public by providing misleading disclosures about the cybersecurity incidents they have encountered,” said Sanjay Wadhwa, acting director of the SEC’s Division of Enforcement. “Here, the SEC’s orders find that these companies provided misleading disclosures about the incidents at issue, leaving investors in the dark about the true scope of the incidents.”
According to the SEC, each company committed different violations. Avaya said hackers accessed a “limited number” of companies’ emails but did not say that the hackers also accessed “at least 145 files in its cloud file sharing environment.” Despite knowing about the breach, Check Point “described cyber intrusions and risks” in “generic terms.” Mimecast “minimized the attack by failing to disclose” what code and the quantity of company encrypted credentials that the hackers stole. And Unisys “described its risks from cybersecurity events as hypothetical” even though it was hit by two SolarWinds-related breaches.
The SEC said that all companies collaborated with its investigation and agreed to pay the penalties and “to cease and desist from future violations of the charged provisions,” while also not “admitting or denying” the SEC findings.
Avaya spokesperson Julianne Embry said that the SEC “recognized Avaya’s voluntary cooperation and that we took certain steps to enhance the company’s cybersecurity controls.”
Check Point spokesperson Gil Messing said that “Check Point investigated the SolarWinds incident and did not find evidence that any customer data, code, or other sensitive information was accessed. Nevertheless, Check Point decided that cooperating and settling the dispute with the SEC was in its best interest.”
Mimecast spokesperson Timothy Hamilton said that the company “made extensive disclosures and engaged with our customers and partners proactively and transparently, even those who were not affected,” in response to the SolarWinds hack.
“We believed that we complied with our disclosure obligations based on the regulatory requirements at that time,” Hamilton said.
When reached for comment, Unisys spokesperson Jamie Baid declined to comment and referred to the company’s 8-K filing published on Tuesday. In the document, Unisys said it reached a settlement with the SEC that resolves the regulator’s investigation into the company.
In the last few years, the SEC has imposed a series of new obligations on publicly traded companies when it comes to disclosing data breaches, and their effects on the company and its customers and users.
"*" indicates required fields
Software Asset Management is a business practice that involves managing and optimising the life cycle of software within an organisation.
Software asset management is relevant to many facets of a business - take a look at some of the roles that it can form part of the focus of.
Software vendors come in all shape and sizes - all with their own set of licensing models and rules. We take a look at just a few of them.
As a constantly evolving subject, SAM is not without its challenges. We take a look at some of the most common ones.
Wondering what an investment in SAM could do for your business? Fill out a few details and find out what return you could get!
Answer a few questions about your SAM infrastructure & experience, and we'll put together a personalised recommendation for the future.
A simple health check of what's being used across your Office 365 estate in this FREE, Microsoft backed and easy to setup review.
Just like you would with your vehicle each year, get an annual check up of your software asset management programme.
Overwhelmed by the task of documenting the steps for a successful SAM programme? Get the experts in to help!
Concerned your SAM tools aren't covering your whole estate? Or on the look out for an entirely new tool? Get us in to assist.
Not content with covering all things SAM related, we've teamed up with Capital to provide a comprehensive hardware asset management review.
A simple, one-time reconciliation of the software you have deployed versus the licence entitlement you own.
A regularly scheduled analysis of your organisation's estate, specifically adapted to your needs and budget.
A full appraisal of your Microsoft 365 setup and how best to optimise it through automated recommendations.
An add-on to our SAMplicity One, MOT and Plus offerings, quickly diagnose your ability to migrate your resources to the cloud.
In collaboration with law firm Addleshaw Goddard, ensure the legality of your SAM programme and get assistance with any contract disputes.
Available as standard with SAMplicity Plus, ensure you're compliant if you're unexpectedly audited by a vendor.
We've teamed up with some of the forefront experts in licensing knowledge so you can teach yourself to be an expert too.
Stumped by the continually evolving complexities of SAM? Join us for one of our comprehensive courses, either in-person or online.
It’s chock full of useful advice, exclusive events and interesting articles. Don’t miss out!