SEC Drops SolarWinds Case After Years of High-Stakes Cybersecurity Scrutiny

The U.S. Securities and Exchange Commission has abandoned its lawsuit against SolarWinds and its chief information security officer, Timothy G Brown, in a joint motion filed on 20 November 2025. The SEC’s decision to seek dismissal was not framed as reflecting the Commission’s position on any other case.

The agency had, in October 2023, accused SolarWinds and Brown of fraud and internal control failures, alleging the company overstated its cybersecurity practices and failed to disclose known risks, with the 2020 supply chain attack as the context. The attack was attributed to the Russian state-sponsored threat actor known as APT29, and the SEC alleged that Brown was aware of SolarWinds’ cybersecurity risks yet did not resolve them or raise them sufficiently within the organisation.

Earlier, in July 2024, SDNY threw out many of these allegations for lacking plausibility, and the SEC subsequently charged Avaya, Check Point, Mimecast and Unisys for making “materially misleading disclosures” related to the SolarWinds hack.