Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


End of Bibblio RCM includes -->
06:35 PM
Connect Directly

Did Companies Fail to Disclose Being Affected by SolarWinds Breach?

The SEC has sent out letters to some investment firms and publicly listed companies seeking information, Reuters says.

The US Securities and Exchange Commission (SEC) has reportedly opened a probe into whether some companies that were affected by the SolarWinds breach failed to disclose that fact.

Related Content:

What We Know (and Don't Know) So Far About the 'Supernova' SolarWinds Attack

Special Report: Assessing Cybersecurity Risk in Today's Enterprises

New From The Edge: 11 Security Certifications to Seek Out This Summer

News organization Reuters reported on Monday that the agency sent letters to several investment firms and publicly listed companies last week, seeking voluntary information from them regarding whether they had been victims of the SolarWinds breach. The SEC requires organizations to disclose any event, including security breaches, that could affect share prices.

The SEC is also looking into whether companies that were affected by the breach had experienced any kind of lapse of internal security controls. In addition, the agency is examining the policies that some of these organizations had for protecting consumer data, according to Reuters, quoting two unnamed sources that it said were close to the probe.

Organizations that respond to the SEC letter and voluntarily provide details of any breach that they might have experienced because of the SolarWinds intrusion will not face enforcement action, Reuters said, quoting its sources.

What remains unclear if whether any action will be taken against organizations that refuse to respond or provide details of any compromise they might have experienced. It's also not clear why the SEC believes the companies to which it sent the investigation letters were affected by the breach at SolarWinds. The SEC did not immediately respond to a Dark Reading email seeking more information on the reported probe.

The breach at SolarWinds — which began early 2019 but was only discovered in December 2020 — resulted in malware being distributed to nearly 18,000 of the company's customers worldwide. A few of them, including nine US federal agencies and numerous private companies and tech firms such as FireEye and Microsoft, were later targeted for further compromise and data theft.

US authorities have blamed Russia's foreign intelligence service (SVR) for the whole campaign, which they have said was conducted for cyber-espionage purposes. Some security experts believe the number of organizations that were impacted by the breach is likely larger than what is known.

SolarWinds itself has described the breach as starting in January 2019 or nearly two years before the company discovered the intrusion — and that only after FireEye notified it about a potential compromise. The company says the attack began with threat actors gaining access to its software development environment and planting malware called "Sunspot" into a source-code file. It's unclear yet how the threat actors might have gained initial access to the company's build environment. The attackers later used Sunspot to insert a Trojan called Sunburst/Solarigate into builds of a SolarWinds network management product called Orion. Those software updates were sent out to thousands of SolarWinds customers.

The SolarWinds attack has focused considerable attention on supply chain security especially within federal government agencies. In a report following the SolarWinds incident, the Government Accountability Office (GAO) described none of the 23 federal civilian agencies as having fully implemented best practices for managing risks within the supply chain for information and communication technologies. According to the GAO, just five agencies have an enterprisewide supply chain risk management (SCRM) strategy and just five have established executive oversight over the function. Not one agency, though, has an actual process for conducting agencywide assessments of supply chain risks. The GAO has made some 145 recommendations to all federal civilian agencies on how to better address supply chain risks.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Threaded  |  Newest First  |  Oldest First
User Rank: Author
6/22/2021 | 10:37:59 AM
US Federal SCRM challenges
The GAO also published a report on agency SCRM practices (or lack thereof) in 2012. As the new report shows, little action was taken by the agencies between then and now. The primary reasons agency managers give (off the record) for not doing anything about these long-standing problems is lack of funding and lack of knowledge about what to do. Both of which are problems that can be overcome. By strong leadership. The USG spends ~$500B/yr, so its hard to say that money cannot be found if a political choice is made to dedicate it to this matter, and NIST has several years ago published SCRM guidance for the agencies (which is mandatory for the agencies).

So the real problem isn't money or knowledge, it is that nobody in a position of authority in the federal government has made addressing technology supply chain risks their issue in a meaningful way (i.e., other than including it in talking points).
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
Everything You Need to Know About DNS Attacks
It's important to understand DNS, potential attacks against it, and the tools and techniques required to defend DNS infrastructure. This report answers all the questions you were afraid to ask. Domain Name Service (DNS) is a critical part of any organization's digital infrastructure, but it's also one of the least understood. DNS is designed to be invisible to business professionals, IT stakeholders, and many security professionals, but DNS's threat surface is large and widely targeted. Attackers are causing a great deal of damage with an array of attacks such as denial of service, DNS cache poisoning, DNS hijackin, DNS tunneling, and DNS dangling. They are using DNS infrastructure to take control of inbound and outbound communications and preventing users from accessing the applications they are looking for. To stop attacks on DNS, security teams need to shore up the organization's security hygiene around DNS infrastructure, implement controls such as DNSSEC, and monitor DNS traffic
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2023-05-26
Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4.7.
PUBLISHED: 2023-05-26
Django-SES is a drop-in mail backend for Django. The django_ses library implements a mail backend for Django using AWS Simple Email Service. The library exports the `SESEventWebhookView class` intended to receive signed requests from AWS to handle email bounces, subscriptions, etc. These requests ar...
PUBLISHED: 2023-05-26
Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to `type="text"` via a javascript "Show Password" button. This differs from the expected behavior which always obfuscates `ty...
PUBLISHED: 2023-05-26
Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was...
PUBLISHED: 2023-05-26
GDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted capture file