SolarWinds chief executive Sudhakar Ramakrishna speaks during a 2021 Senate Intelligence Committee hearing on Capitol Hill. has rejected the Securities and Exchange Commission’s bid to oversee corporate cybersecurity controls, relieving companies worried they would be penalized by regulators after breaches by well-resourced hackers.brought by the agency against 2020 hacking victim SolarWinds, U.S. District Judge Paul A.
“The SEC’s rationale, under which the statute must be construed to broadly cover all systems public companies use to safeguard their valuable assets, would have sweeping ramifications,” Engelmayer wrote in“It could empower the agency to regulate background checks used in hiring nighttime security guards, the selection of padlocks for storage sheds, safety measures at water parks on whose reliability the asset of customer goodwill depended, and the lengths and configurations of passwords...
The federal judge in Manhattan also dismissed SEC claims that SolarWinds’ disclosures after it learned its customers had been affected improperly covered up the gravity of the breach, in which Russian intelligence agents were accused of burrowing through SolarWinds software for more than a year to get inside multiple federal agencies and big tech companies. U.S.
The SEC “plausibly alleges that SolarWinds and Brown made sustained public misrepresentations, indeed many amounting to flat falsehoods, in the Security Statement about the adequacy of its access controls,” Engelmayer wrote. “Given the centrality of cybersecurity to SolarWinds’ business model as a company pitching sophisticated software products to customers for whom computer security was paramount, these misrepresentations were undeniably material.