“These do not plausibly plead actionable deficiencies in the company’s reporting of the cybersecurity hack. They impermissibly rely on hindsight and speculation.”
Judge Paul Engelmayer’s 107-page ruling tossed the claims over how SolarWinds disclosed SUNBURST and every claim about its internal accounting and disclosure controls. He kept the securities fraud claims, finding the company’s statements “materially false and misleading in numerous aspects.” The SEC charged CISO Timothy Brown personally, and security chiefs everywhere panicked. Lying about your security before a breach is still fraud. Fumbling the disclosure after one is not.