Detailed narrative of event

Detailed Narrative of Events

(Extended Documentation for SEC v. SolarWinds Corp. et al. Case Study)

Table of contents

1. Overview
2. SUNBURST disclosure and scrutiny (December 2020)
3. Investor and regulatory scrutiny (2021–2023)
4. SEC enforcement action filed (October 2023)
5. District court motion to dismiss (July 2024)
6. Stipulation of dismissal (November 2025)

---

Overview

SolarWinds became a focal point of securities and cybersecurity enforcement discussion after December 2020, when the company publicly disclosed that it was a victim of a supply-chain attack (SUNBURST) affecting customers of its Orion platform. Investors, customers, and regulators scrutinized prior public statements about security and internal assessments. The SEC later filed a civil enforcement action alleging securities law violations tied to disclosures and controls; the litigation proceeded through motion practice and ultimately ended in a stipulated dismissal with prejudice in 2025.

---

SUNBURST disclosure and scrutiny (December 2020)

In December 2020, SolarWinds publicly disclosed compromise of its build environment and distribution of trojanized software updates to customers—a supply-chain scenario with widespread enterprise impact. Forensic and intelligence reporting attributed the campaign to a highly capable threat actor. The disclosure triggered securities market reactions and regulatory interest in what was known and when about risk and controls.

---

Investor and regulatory scrutiny (2021–2023)

Parallel tracks included customer incident response, government coordination, congressional attention, and private litigation themes (consult dockets). SEC staff investigated disclosure and internal control questions in light of public statements and Form filings.

---

SEC enforcement action filed (October 2023)

On October 30, 2023, the SEC filed a complaint in the Southern District of New York against SolarWinds and Timothy G. Brown, alleging securities fraud, internal control failures, and related claims tied to cyber disclosures and controls (see SEC press release 2023-227 and complaint PDF on sec.gov).

---

District court motion to dismiss (July 2024)

In July 2024, the district court issued an opinion on motions to dismiss reported at 741 F. Supp. 3d 37, addressing pleading and legal issues in the enforcement action (read the opinion for authoritative analysis).

---

Stipulation of dismissal (November 2025)

On November 20, 2025, the parties filed a joint stipulation dismissing the action with prejudice. The SEC issued Litigation Release LR-26423 describing the dismissal. Practitioners should treat the public docket as the authoritative procedural record for finality and any terms reflected in court orders.