The Securities and Exchange Commission on Monday charged software company SolarWinds Corp.
SWI,
and its chief information security officer with fraud and the failure to fully disclose weaknesses in the company’s cybersecurity protocols. The agency alleged that from at least SolarWinds’ October 2018 IPO through its December 2020 announcement that it had been hit by a large cyberattack, the company and its chief information security officer, Timothy Brown, “defrauded investors by overstating SolarWinds’ cybersecurity practices and understating or failing to disclose known risks.” The SEC’s complaint alleges that despite warnings from employees, Brown “failed to resolve the issues or, at times, sufficiently raise them further within the company.” Gurbir Grewal, director of the SEC’s enforcement division, alleged in a statement that “for years, SolarWinds and Brown ignored repeated red flags about SolarWinds’ cyber risks, which were well known throughout the company and led one of Brown’s subordinates to conclude: ‘We’re so far from being a security minded company.’” The agency is seeking civil penalties and an officer and director bar against Brown. Shares of SolarWinds were down 0.2% after hours.
