The Securities and Exchange Commission fined four companies on Tuesday with misleading investors about the impact the 2020 hack of SolarWinds had on their own systems.
Unisys, Avaya, Check Point, and Mimecast will each pay civil penalties to settle the agency’s charges that they downplayed the impacts of the hack through their respective public disclosures.
“While public companies may become targets of cyberattacks, it is incumbent upon them to not further victimize their shareholders or other members of the investing public by providing misleading disclosures about the cybersecurity incidents they have encountered,” Acting Director of the SEC’s Division of Enforcement Sanjay Wadhwa said in a statement.
In 2020, a Russian backed group planted malware in the SolarWinds system that sent out updates to SolarWinds’s Orion software. When several thousand of the company’s clients installed the update, they also unknowingly installed the malware. It ended up becoming one of the most destructive and costly cyberattacks in history, as NPR put it.
According to the SEC, Unisys, Avaya, and Check Point learned in 2020, and Mimecast learned in 2021, that the actor behind the hack had accessed their systems without authorization. Still, the SEC argued, each minimized the incident in public disclosures. The SEC said that Unisys also described its risk as hypothetical, when it already knew it had been breached twice.
Unisys will pay a $4 million civil penalty. Avaya will pay $1 million, Check Point will pay $995,000, and Mimecast will pay $990,000.
A Check Point spokesperson said: “As mentioned in the SEC’s order, Check Point investigated the SolarWinds incident and did not find evidence that any customer data, code, or other sensitive information was accessed. Nevertheless, Check Point decided that cooperating and settling the dispute with the SEC was in its best interest and allows the company to maintain its focus on helping its customers defend against cyberattacks throughout the world.”
An Avaya spokesperson made a similar comment. “We are pleased to have resolved with the SEC this disclosure matter related to historical cybersecurity issues dating back to late 2020, and that the agency recognized Avaya’s voluntary cooperation and that we took certain steps to enhance the company’s cybersecurity controls,” the spokesperson said. “Avaya continues to focus on strengthening its cybersecurity program, both in designing and providing our products and services to our valued customers, as well as in our internal operations.”
Spokespeople for Unisys and Mimecast did not immediately return Fast Company‘s requests for comment.
Jelentkezéshez jelentkezzen be
EGYÉB POSTS Ebben a csoportban
When Donald Trump returned to the White House in 2025, many in the tech world hoped his promises to champion artificial intelligence and cut regulation would outweigh the risks of his famously vol
The first 27 satellites for Amazon’s Kuiper broadband internet constellation were launched into space from Florid
There are so many ways to die. You could fall off a cliff. A monk could light you on fire. A bat the size of a yacht could kick your head in. You’ve only just begun the game, and yet here you are,
Former Tinder CEO Renate Nyborg launched Meeno less than two years ago with the intention of it being an AI chatbot that help
The most indelible image from Donald Trump’s inauguration in January is not the image of the president taking the oath of office without his hand on the Bible. It is not the image of the First Lad
Ernest Hemingway had an influential theory about fiction that might explain a lot about a p
The first 100 days of Trump’s second presidential term have included a surprising player that doesn’t seem likely to go away anytime soon: Signal.
The encrypted messaging pl
