Overview
- The SEC, SolarWinds, and CISO Timothy G. Brown filed a joint motion on November 20 to dismiss the civil enforcement action, and the commission offered no public rationale for ending the case.
- The agency’s 2023 lawsuit alleged SolarWinds misled investors about its cybersecurity practices tied to the 2020 supply‑chain breach known as Sunburst.
- A federal judge in July 2024 dismissed many of the SEC’s allegations as implausible and overly reliant on hindsight and speculation.
- SolarWinds and its executives called the outcome a vindication and said it should ease concerns among CISOs about a chilling effect on disclosure.
- The dismissal coincided with the FCC rescinding certain Biden‑era cyber rules, and the broader Sunburst campaign has been attributed to Russia‑linked APT29, with about 18,000 downloads of tainted software and roughly 100 known follow‑on intrusions.