Loading story…
The U.S. Securities and Exchange Commission (SEC) has officially dropped its high-profile lawsuit against SolarWinds and its Chief Information Security Officer, Timothy Brown, which alleged that the company misled investors about its cybersecurity practices prior to the 2020 SUNBURST supply chain attack. The SEC, SolarWinds, and Brown jointly requested the court to dismiss the civil enforcement action, with the SEC stating the dismissal was at its discretion and not indicative of its stance on other cases. The lawsuit, filed in 2023, accused SolarWinds and its CISO of failing to disclose cybersecurity weaknesses between the company's IPO in 2018 and the discovery of the SUNBURST attack in December 2020, which allowed Russian state actors to compromise the Orion IT management software and breach numerous high-profile organizations and U.S. government agencies.
SolarWinds expressed relief and satisfaction with the outcome, emphasizing that the facts demonstrated appropriate conduct by its security team and hoping the resolution would alleviate concerns among CISOs about personal liability in similar cases. The SEC's action had previously sparked significant debate within the cybersecurity community, with many leaders warning of a potential chilling effect on security disclosures. The SUNBURST attack, attributed to Russia's Cozy Bear, resulted in approximately 18,000 organizations downloading compromised software, with about 100 suffering further breaches, including major corporations and several U.S. federal departments. The conclusion of the lawsuit marks a significant moment in the ongoing discussion about corporate cybersecurity accountability and regulatory oversight.
See the reporting duties and controls this puts on the clock.
8 events from the most recent confirmed update back to the earliest known activity.
SolarWinds previously agreed to settle a related investor class-action lawsuit for $26 million. Coverage described the amount as less than 1% of the company's market capitalization.
After the SEC dropped the case, SolarWinds publicly welcomed the decision and said the outcome vindicated the company and its security personnel. Company leadership also said SolarWinds had become stronger and better prepared since the 2020 attack.
On or before November 20, 2025, the SEC voluntarily dismissed its 2023 lawsuit against SolarWinds and Timothy Brown, saying it did so in the exercise of its discretion. The dismissal ended a closely watched case that many CISOs feared could expand personal liability for security leaders.
Near the end of the Biden administration, the SEC fined four companies for inadequate or misleading disclosures connected to the SolarWinds incident. The enforcement actions showed the agency continued pursuing cyber disclosure cases beyond SolarWinds itself.
In July 2024, the U.S. District Court for the Southern District of New York threw out most of the SEC's claims against SolarWinds and Brown. The court found key parts of the SEC's case relied improperly on hindsight and speculation.
In 2023, the SEC filed a lawsuit against SolarWinds and its chief information security officer, Timothy G. Brown, alleging they misled investors about the company's cybersecurity practices and risks tied to the 2020 breach. The complaint included fraud and internal controls allegations.
Reporting and later legal coverage attributed the 2020 SolarWinds breach to Russian state-sponsored actors, including APT29 and the Russian Foreign Intelligence Service. This attribution became a central part of the incident's public understanding.
A major supply-chain attack involving malicious code inserted into SolarWinds' Orion software was discovered in 2020. The campaign enabled intrusions into numerous large companies and U.S. federal agencies.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
9 references tracked. Mallory keeps watching after this page renders.
databreaches.net
Open sourcetherecord.media
Open sourcescworld.com
Open sourcegovinfosecurity.com
Open sourcebankinfosecurity.com
Open sourcethehackernews.com
Open sourcego.theregister.com
Open sourcenextgov.com
Open sourcecyberscoop.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Securities and Exchange Commission (SEC) has dismissed its lawsuit against SolarWinds and its Chief Information Security Officer, Tim Brown, a decision that has been met with widespread relief among cybersecurity leaders. The case, which followed the high-profile SolarWinds supply chain breach, had placed significant scrutiny on the personal and professional accountability of CISOs, raising concerns about the risks faced by security executives in the wake of major cyber incidents. Industry experts note that while the dismissal alleviates immediate legal pressure, it does not eliminate the broader challenges and responsibilities that CISOs continue to face regarding cybersecurity governance and risk management. The outcome of the lawsuit is seen as a potential turning point in how regulators, boards, and executives approach cybersecurity accountability, emphasizing the need for shared responsibility across organizations. However, experts caution that the legal and regulatory landscape remains uncertain, and future policy shifts could once again place CISOs under regulatory scrutiny. The case has also sparked discussions about the structural tensions in cybersecurity leadership, particularly the gap between responsibility and authority for security professionals in large organizations.
Jun 29, 2026
A suspected Russian intelligence operation compromised SolarWinds' Orion software build process and pushed trojanized updates containing the **`SUNBURST`** backdoor to customers beginning in 2020, giving attackers a stealthy foothold inside government and private-sector networks. U.S. agencies including Treasury, Commerce, Homeland Security, State, and parts of the Pentagon were drawn into the response, while investigators and public reporting said roughly **18,000** customers received the malicious update and a smaller set suffered follow-on intrusions. FireEye's discovery of its own breach helped expose the campaign, and later technical reporting tied the operation to second-stage malware including **`TEARDROP`** and **`Raindrop`**, with officials assessing the activity as a long-running espionage effort rather than destructive sabotage. The victim list expanded beyond federal agencies to major enterprises and institutions including **Cisco, Intel, Nvidia, VMware, Deloitte, Belkin, Kent State University**, and **Malwarebytes**, though several said they found the tainted software without evidence of deeper compromise. Subsequent reporting and congressional scrutiny also focused on how the attackers abused Microsoft cloud and identity weaknesses to impersonate users and access email, with lawmakers pressing Microsoft over claims that internal warnings had been missed before the SolarWinds campaign. SolarWinds' CEO later apologized for blaming an intern for a weak password issue, and said the intrusion may have begun as early as **2019**, underscoring how long the attackers may have operated undetected and how difficult remediation became for affected organizations and critical infrastructure operators.
Aug 21, 2026
SolarWinds disclosed that the **SUNBURST** compromise of its Orion platform led to actual follow-on intrusions at fewer than 100 customers, despite roughly 18,000 organizations downloading tainted updates. Investigators said the attackers, widely attributed by the U.S. government to Russia’s **SVR** and tracked as **NOBELIUM/UNC2452/Dark Halo**, inserted a backdoor into signed Orion updates and used delayed activation, DNS-based victim profiling, and selective second-stage deployment to focus on high-value targets. Victims included U.S. government agencies and private-sector organizations, while related activity also reached Mimecast, where the same actor accessed encrypted customer service account credentials and compromised certain authentication certificates affecting a small number of Microsoft 365 tenants. Incident response findings showed the campaign extended well beyond the initial Orion malware, with attackers stealing email, moving laterally through on-premises networks, bypassing MFA in some cases, forging SAML tokens, and abusing Azure AD and Microsoft 365 to access cloud resources. Research from Volexity, Symantec, Microsoft, and others detailed command-and-control through `avsvmcloud[.]com`, HTTP-based second-stage operations, mailbox theft, and stealthy use of legitimate identity infrastructure. In response, **CISA** issued an emergency directive, released the **CHIRP** detection tool, and published eviction guidance warning that full remediation may require rebuilding identity systems, rotating credentials, and isolating affected networks to remove long-term adversary access.
Aug 15, 2026