October 30, 2023 the Wall avenue Journal broke information that the US Safety and Trade Fee sued Solarwinds. Listed below are the primary few paragraphs and there’s a hyperlink to the total WSJ article on the backside : “the software program firm victimized by Russian-linked hackers over three years in the past, alleging the agency defrauded shareholders by repeatedly deceptive them about its cyber vulnerabilities and the flexibility of attackers to penetrate its programs.
“The SEC’s lawsuit is a milestone in its evolving try to control how public firms cope with cybersecurity. A hack that steals enterprise secrets and techniques or buyer information typically pummels the sufferer firm’s inventory worth, displaying why corporations with public shareholders need to precisely disclose such threats, the SEC says. The regulator not too long ago imposed stricter cybersecurity reporting guidelines for public firms.
“The lawsuit additionally presents a distinct view of the breach of SolarWinds, which portrayed itself as the sufferer of a extremely refined intrusion that different authorities businesses mentioned was a part of a Russian espionage marketing campaign. The intrusion went undiscovered for greater than a yr and gave intruders footholds in a minimum of 9 federal businesses that used SolarWinds’ software program.
“The SEC’s position in cybersecurity is controversial, with enterprise teams saying its investigations can shift blame to the sufferer. Different law-enforcement businesses desire to maintain quiet whereas they probe hackers and typically conflict with the SEC over its calls for for disclosure. The SolarWinds case is the primary time securities regulators have gone to courtroom with civil-fraud claims—essentially the most severe cost on the company’s disposal—towards a public firm over a hack.”
I counsel you ship this WSJ Hyperlink to your C-level InfoSec resolution makers. This can be a first.