On July 18, 2024, in a highly anticipated ruling, U.S. District Judge Paul A. Engelmayer dismissed a substantial portion of the U.S. Securities Exchange Commission’s case against SolarWinds Corporation and its Chief Information Security Officer, Timothy Brown. As we previously reported, in October 2023 the SEC brought a far-reaching case against SolarWinds and Brown, alleging that SolarWinds misleadingly touted its cybersecurity practices and products, and misled investors about a series of heavily publicized cyber-attacks that targeted the company, culminating in the December 2020 Sunburst malware attack. In addition to charging SolarWinds with various violations of the U.S. federal securities laws, the SEC also targeted the company’s CISO, Brown, as both a primary violator and an aider and abettor of the charges. The case drew significant public attention, and a series of business groups and other interested parties filed amicus briefs, largely in support of the company’s position.

At a high level, the charges against SolarWinds and Brown involved allegations of:

• negligent securities fraud under Section 17(a) of the Securities Act of 1933;
• reckless/intentional securities fraud under Section 10(b) of the Securities Exchange Act of 1934 and related rules;
• falsely filing SEC reports under Section 13(a) of the 1934 Act and related rules;
• failing to maintain sufficient internal controls over financial reporting under Section 13(b)(2)(B) of the 1934 Act; and
• failing to maintain adequate disclosure controls and procedures under Rule 13a-15(a) under the 1934 Act.

SolarWinds and Brown moved to dismiss the SEC’s case for failure to state a claim under Federal Rule of Civil Procedure 12(b)(6). Notably, at the motion to dismiss stage, the judge is generally required to assume that all well-pled facts in the SEC’s amended complaint are true, and must further draw all reasonable inferences in favor of the SEC as plaintiff. By design, the bar is set high for a defendant to succeed in dismissing claims under Rule 12(b)(6).

Judge Engelmayer’s 107-page order and opinion on the motion to dismiss carefully analyzed each of the SEC’s claims under the amended complaint. For ease of discussion, the judge described the SEC’s claims regarding the company’s conduct before the Sunburst attack as the “pre-Sunburst claims,” and those regarding the company’s conduct after the attack as the “post-Sunburst claims.”

With respect to pre-Sunburst disclosures, the Court sustained the SEC's claims of securities fraud based on a “Security Statement” surrounding various cybersecurity practices that SolarWinds published on its corporate website. Litigation over those claims will therefore continue. The Court dismissed, however, the pre-Sunburst claims of securities fraud and false filings based on other statements and filings. As to post-Sunburst disclosures, the Court dismissed all claims. According to Judge Engelmayer, these claims do not plausibly plead actionable deficiencies in SolarWinds’ reporting. Instead, the judge reasoned that the claims impermissibly rely on hindsight and speculation.

Finally, the Court dismissed as ill-pled the SEC’s claims relating to SolarWinds’ internal controls over financial reporting and disclosure controls and procedures. In doing so, Judge Engelmayer conducted a lengthy analysis of statutory text, history and the fundamental authority of the SEC to bring internal controls claims on the basis of cybersecurity incidents. He concluded that “the history and purpose of the statute confirm that cybersecurity controls are outside the scope of” internal controls over financial reporting. The claims against SolarWinds involving internal controls were perhaps the most controversial ones the SEC brought, and surfaced again in another recent, unrelated SEC enforcement case involving a ransomware attack at RR Donnelley & Sons Co.