On October 22, 2024, the Securities and Exchange Commission charged four companies with making materially misleading disclosures about

SEC charges four companies for misleading disclosures regarding the SolarWinds cyberattack, imposing fines totaling $6 million.

The agency said Unisys, Avaya Holdings, Check Point Software Technologies and Mimecast provided misleading disclosures about the incidents, leaving investors in the dark about their "true scope."

The Securities and Exchange Commission fined four cybersecurity companies for downplaying to investors the impact the 2020 Russian hack of SolarWinds had on their own systems. Why it matters: It's rare to see companies come under regulatory fire for cybersecurity disclosures.

The SEC concluded that four tech companies misled investors and minimized the damage they suffered from the SolarWinds supply chain hack.

Despite knowing threat actors had accessed systems and exfiltrated data, several companies released statements downplaying the impact of the attack.

The companies include IT security firm Check Point and email security provider Mimecast, which were ensnared in the SolarWinds breach four years ago.

Four current or former public companies will pay a total of nearly $7 million in fines to settle charges by the Securities and Exchange Commission that they underplayed or failed to disclose material information about how the SolarWinds Orion hack affected them.