Yesterday, the SEC issued a Litigation Release announcing that it had filed a joint stipulation dismissing its high-profile cybersecurity disclosure enforcement action against SolarWinds and its CISO.  The enforcement action followed a massive Russian cyberattack against the company and challenged alleged “hypothetical risk factor” disclosures and other statements that purported to describe the company’s cybersecurity practices and policies.

The case was notable for, among other things, the SEC’s unusual decision to bring charges against SolarWinds’ CISO and its argument that the company’s cybersecurity weaknesses represented internal accounting controls failures.  The SEC took a big hit last year when a federal judge dismissed all of its claims against the company and its CISO with respect to statements made prior to the attack, and all but one claim relating to post-attack disclosures.

Earlier this year, the SEC and SolarWinds reached a tentative settlement of the case, but yesterday’s announcement apparently takes that off the table. Here’s what the Litigation Release had to say:

The U.S. Securities and Exchange Commission today filed a joint stipulation with Defendants SolarWinds Corporation and its Chief Information Security Officer, Timothy G. Brown, to dismiss, with prejudice, the Commission’s ongoing civil enforcement action. As stated in the joint stipulation, the Commission’s decision to seek dismissal is “in the exercise of its discretion” and “does not necessarily reflect the Commission’s position on any other case.”

The dismissal of the SolarWinds enforcement action coincides with the release of a Cornerstone Research Report finding that SEC enforcement proceedings against public companies declined significantly during the 2025 fiscal year.  Check out Kevin LaCroix’s blog on “The D&O Diary” for more information on that report.

– John Jenkins