More than a decade ago, I expressed concern about the Securities and Exchange Commission's predilection for targeting victims of crimes. That concern related to an enforcement action against a company that had been victimized by a multimillion dollar embezzlement by its principal accounting officer.

Now, the SEC is targeting companies victimized by cyber attacks. Earlier this spring, the SEC strong armed R.R. Donnelley & Sons Company into paying a $2.1 million to settle disclosure and internal control failure charges relating to cybersecurity incidents and alerts in late 2021. See The SEC Continues Its War On Crime Victims.

I am therefore heartened by a statement recently released by Commissioners Hester Peirce and Mark Uyeda decrying the SEC's response to the 2019-2020 cyberattacks against SolarWinds Corporation (footnotes omitted):

How has the Commission responded? By first charging SolarWinds in district court and, in today’s settled proceedings, charging four customers of its Orion software, with violations of the federal securities laws. Today’s proceedings impose nearly $7 million in penalties against these victims of the cyberattacks.

In a footnote, the Commissioners note that the U.S. District Court recently dismissed most of the claims the Commission brought against SolarWinds. SEC v. SolarWinds Corp., 2024 WL 3461952 (S.D.N.Y. July 18, 2024).

The Commissioners' conclude:

The Commission needs to start treating companies subject to cyberattacks as victims of a crime, rather than perpetrators of one. Yes, the Commission must protect investors by ensuring that companies disclose material incidents, but donning a Monday morning quarterback’s jersey to insist that immaterial information be disclosed — as the Commission did in today’s four proceedings — does not protect investors. It does the opposite.

I concur.