The Securities and Exchange Commission (SEC) announced on Tuesday that it charged and imposed penalties on four companies for making misleading disclosures linked to the 2019 SolarWinds espionage attack.
The four companies charged are cybersecurity firms Check Point, which will pay a civil penalty of $995,000, and Mimecast, which will pay $990,000; and the tech companies Unisys, which will pay $4 million, and Avaya, which will pay $1 million.
All of these companies were victims of the hack that hit SolarWinds, which affected several other companies and government agencies that used SolarWinds software. According to the SEC, each company committed different violations that “negligently” downplayed and minimized the damage of the breaches.
“While public companies may become targets of cyberattacks, it is incumbent upon them to not further victimize their shareholders or other members of the investing public by providing misleading disclosures about the cybersecurity incidents they have encountered,” said Sanjay Wadhwa, acting director of the SEC’s Division of Enforcement. “Here, the SEC’s orders find that these companies provided misleading disclosures about the incidents at issue, leaving investors in the dark about the true scope of the incidents.”
According to the SEC, each company committed different violations. Avaya said hackers accessed a “limited number” of companies’ emails but did not say that the hackers also accessed “at least 145 files in its cloud file sharing environment.” Despite knowing about the breach, Check Point “described cyber intrusions and risks” in “generic terms.” Mimecast “minimized the attack by failing to disclose” what code and the quantity of company encrypted credentials that the hackers stole. And Unisys “described its risks from cybersecurity events as hypothetical” even though it was hit by two SolarWinds-related breaches.
The SEC said that all companies collaborated with its investigation and agreed to pay the penalties and “to cease and desist from future violations of the charged provisions,” while also not “admitting or denying” the SEC findings.
Avaya spokesperson Julianne Embry told TechCrunch that the SEC “recognized Avaya’s voluntary cooperation and that we took certain steps to enhance the company’s cybersecurity controls.”
Check Point spokesperson Gil Messing told TechCrunch that “Check Point investigated the SolarWinds incident and did not find evidence that any customer data, code, or other sensitive information was accessed. Nevertheless, Check Point decided that cooperating and settling the dispute with the SEC was in its best interest.”
Mimecast spokesperson Timothy Hamilton told TechCrunch that the company “made extensive disclosures and engaged with our customers and partners proactively and transparently, even those who were not affected,” in response to the SolarWinds hack.
“We believed that we complied with our disclosure obligations based on the regulatory requirements at that time,” Hamilton said.
When reached by TechCrunch for comment, Unisys spokesperson Jamie Baid declined to comment and referred to the company’s 8-K filing published on Tuesday. In the document, Unisys said it reached a settlement with the SEC that resolves the regulator’s investigation into the company.
In the last few years, the SEC has imposed a series of new obligations on publicly traded companies when it comes to disclosing data breaches, and their effects on the company and its customers and users.