SEC fines four companies $7 million for ‘misleading cyber disclosures’ about SolarWinds hack

The Securities and Exchange Commission (SEC) announced Tuesday that it has charged and fined four companies for making misleading disclosures related to the 2019 SolarWinds data breach.

The four companies charged are cybersecurity firm Check Point, which will pay a civil penalty of $995,000; Mimecast, which will pay $990,000; and technology companies Unisys, which will pay $4 million, and Avaya, which will pay $1 million.

All of these companies were victims of the SolarWinds hack, which affected several other companies and government agencies that use SolarWinds software. According to the SEC, each company committed a different breach “negligently” mitigated and mitigated the damages of the breach.

“While public companies may be victims of cyber attacks, it is incumbent upon them not to continue to victimize their shareholders or other members of the investing community by providing misleading disclosures about cyber security incidents they have experienced,” said Sanjay Wadhwa, the SEC’s acting director. Division of Enforcement. “Here, the SEC’s orders find that these companies provided misleading disclosures about the events at issue, leaving investors in the dark about the true scope of the events.”

According to the SEC, each company commits a different violation. Avaya said the hackers accessed a “limited number” of company emails, but did not say the hackers also accessed “at least 145 files on its cloud file sharing platform.” Despite knowing about the breach, Check Point “described the cyber intrusion and risk” in “general terms.” Mimecast “mitigated the attack by failing to disclose” what code and amount of encrypted company data the hackers stole. And Unisys “described its risks from cybersecurity incidents as hypothetical” despite experiencing two breaches related to SolarWinds.

The SEC said all companies cooperated with its investigation and agreed to pay the fines and “cease and desist from future violations of the charging provisions,” while also “neither admitting nor denying” the SEC’s findings.

Avaya spokeswoman Julianne Embry told TechCrunch that the SEC “recognized Avaya’s voluntary cooperation and that we have taken some steps to improve the company’s cybersecurity controls.”

Check Point spokesperson Gil Messing told TechCrunch that “Check Point investigated the SolarWinds incident and found no evidence that any customer data, code, or other sensitive information was accessed. However, Check Point decided that cooperating and resolving the dispute with the SEC was more beneficial.

Mimecast spokesman Timothy Hamilton told TechCrunch that the company “has made extensive disclosures and communicated with our customers and partners proactively and transparently, even those who were not affected,” in response to the SolarWinds hack.

“We believed we were in compliance with our disclosure obligations based on regulatory requirements at the time,” Hamilton said.

When TechCrunch reached out for comment, Unisys spokesperson Jamie Baid declined to comment, referring back to the company’s 8-K filing published Tuesday. In the document, Unisys said it reached an agreement with the SEC that resolves the regulator’s investigation into the company.

Over the past few years, the SEC has placed a series of new obligations on publicly traded companies when it comes to disclosing data breaches, and their consequences for the company and its customers and users.