The US Securities and Exchange Commission (SEC) has reportedly opened a probe into whether some companies that were affected by the SolarWinds breach failed to disclose that fact.
News organization Reuters reported on Monday that the agency sent letters to several investment firms and publicly listed companies last week, seeking voluntary information from them regarding whether they had been victims of the SolarWinds breach. The SEC requires organizations to disclose any event, including security breaches, that could affect share prices.
The SEC is also looking into whether companies that were affected by the breach had experienced any kind of lapse of internal security controls. In addition, the agency is examining the policies that some of these organizations had for protecting consumer data, according to Reuters, quoting two unnamed sources that it said were close to the probe.
Organizations that respond to the SEC letter and voluntarily provide details of any breach that they might have experienced because of the SolarWinds intrusion will not face enforcement action, Reuters said, quoting its sources.
What remains unclear if whether any action will be taken against organizations that refuse to respond or provide details of any compromise they might have experienced. It's also not clear why the SEC believes the companies to which it sent the investigation letters were affected by the breach at SolarWinds. The SEC did not immediately respond to a Dark Reading email seeking more information on the reported probe.
The breach at SolarWinds — which began early 2019 but was only discovered in December 2020 — resulted in malware being distributed to nearly 18,000 of the company's customers worldwide. A few of them, including nine US federal agencies and numerous private comp ..
Support the originator by clicking the read the rest link below.
