SEC and SolarWinds aim to settle in securities fraud case.

In an unexpected turn of events in the ongoing securities fraud lawsuit brought by the US Securities and Exchange Commission (“SEC”) against SolarWinds Corp. (“SolarWinds”) and its former chief information security officer (“CISO”), Timothy Brown, all three parties have jointly requested a stay from the judge until the final settlement is approved by the SEC’s four commissioners, anticipated to be no sooner than September 12, 2025.

The SEC filed the lawsuit against software developer SolarWinds and its former CISO in October 2023, alleging that SolarWinds had deceived investors regarding a series of well-publicized cyberattacks aimed at the company, culminating in the Sunburst malware attack in December 2020. Along with accusations of securities fraud and breaching SEC reporting regulations, the SEC also claimed that SolarWinds had violated internal control provisions of the Sarbanes-Oxley Act.

In July 2024, U.S. District Judge Paul A. Engelmayer granted motions to dismiss the majority of the claims against SolarWinds and its former CISO. However, a single set of fraud allegations concerning purported misrepresentations and omissions in a “Security Statement” found on SolarWinds’ website did survive. The Security Statement detailed the company’s cybersecurity practices, which the SEC asserted were deceptive and incomplete. Recently, in June 2025, the SEC expressed intent to proceed to trial and opposed the defendants’ motion to dismiss the remaining claim.

On July 2, 2025, the SEC, SolarWinds, and the company’s former CISO corresponded to the judge through a joint letter, announcing that they had reached a preliminary agreement to settle the case. The final settlement is contingent upon approval by the SEC’s four commissioners. To facilitate the commissioners’ review, the parties requested a stay until at least September 12, 2025. Notably, two of the commissioners have voiced reservations about the SEC’s handling of the case.

At this juncture, it is challenging to predict the exact terms of the impending settlement. Following the change in presidential administration, the SEC has terminated several enforcement actions directed at the cryptocurrency sector, citing imprudence. This shift in approach may also impact the SolarWinds case, potentially leading to its dismissal. Conversely, the settlement could adopt a more conventional resolution strategy, involving reduced charges and mutually agreeable remedies. The requirement for approval from the SEC commissioners suggests that the latter scenario may be more probable. Like any plaintiff, the SEC occasionally opt to resolve enforcement cases after they progress to litigation for various reasons.