SEC THROWS IN THE TOWEL! Drops SolarWinds Fraud Case, Pays NOTHING!

U.S. Securities and Exchange Commission Litigation Release No. 26423, dated November 20, 2025.

The SEC has dismissed its civil enforcement action against SolarWinds Corp. and its Chief Information Security Officer, Timothy G. Brown. This dismissal was filed as a joint stipulation by both parties. The SEC stated this decision was made in its discretion and does not set a precedent for other cases.

In Plain English

Imagine the SEC was like a referee in a game, and they accused a company and its security boss of breaking some rules. Now, the referee and the accused have agreed to stop the game and dismiss the case. The referee said this doesn't mean they'll stop watching other games, just this one.

Disclaimer: all facts are drawn from the SEC's own filings; the claims described are allegations unless and until a court rules or the parties settle, and some cases end in dismissal.

How the Alleged Scheme Worked

1. Alleged Misrepresentation of Security Controls The SEC alleged that SolarWinds and its CISO, Timothy G. Brown, misled investors about the company's cybersecurity practices and controls. Specifically, the complaint stated that SolarWinds represented to investors that it had 'reasonable and appropriate measures' in place to protect its information systems.
2. Failure to Disclose Known Vulnerabilities The SEC's complaint further alleged that the defendants failed to disclose known vulnerabilities and material weaknesses in SolarWinds' cybersecurity program. This included information about the company's security infrastructure and its ability to prevent or detect security breaches.
3. Misleading Statements on Security Posture The company and its CISO allegedly made misleading statements regarding SolarWinds' security posture. The SEC pointed to statements that suggested a robust and effective cybersecurity program, which the agency claimed was not reflective of the actual state of affairs.
4. Impact on Investor Confidence These alleged misrepresentations were made in the context of significant cybersecurity events, including the "SUNBURST" attack. The SEC contended that the company's public statements did not adequately inform investors about the risks and the true state of their security.
5. SEC Files Civil Enforcement Action The Securities and Exchange Commission filed a civil enforcement action against SolarWinds Corp. and Timothy G. Brown. The complaint was initially filed on October 30, 2023, and an amended complaint was filed on February 16, 2024.
6. Court's Partial Grant of Motion to Dismiss On July 18, 2024, the Court entered an order on the Defendants' motion to dismiss, granting the motion in part and denying it in part. This indicated that some claims would proceed while others were dismissed.
7. Joint Stipulation to Dismiss Subsequently, the Commission and the Defendants submitted a joint stipulation to dismiss the litigation. This filing, dated November 20, 2025, indicated an agreement between the parties to end the case.
8. Dismissal with Prejudice Pursuant to the stipulation, the Litigation was dismissed with prejudice. This means the SEC cannot bring the same claims against SolarWinds and Brown again.
9. No Costs or Fees As part of the stipulation, the dismissal was agreed upon without costs or fees to either party. This means neither side will pay the other's legal expenses related to this action.
10. Defendants Waive Claims for Fees and Release Claims Against SEC The defendants waived their rights to seek reimbursement for attorney's fees and costs under various statutes. They also released any and all claims against the Commission and its employees arising from the litigation.

The Enforcement Action

The U.S. Securities and Exchange Commission (SEC) filed a joint stipulation with Defendants SolarWinds Corporation and its Chief Information Security Officer, Timothy G. Brown, to dismiss, with prejudice, the Commission’s ongoing civil enforcement action. The SEC stated that its decision to seek dismissal was "in the exercise of its discretion" and "does not necessarily reflect the Commission’s position on any other case." The complaint, filed on October 30, 2023, and amended on February 16, 2024, alleged that SolarWinds and Brown misled investors about the company's cybersecurity practices and controls. The Court had previously granted in part and denied in part the defendants' motion to dismiss on July 18, 2024. The dismissal was effective November 20, 2025.

Original SEC litigation release ↗ · Browse all cases