SEC fines four companies $7M for ‘misleading cyber disclosures’ regarding SolarWinds hack

The SEC announced civil penalties against Check Point ($995,000), Mimecast ($990,000), Unisys ($4 million), and Avaya ($1 million) for providing misleading disclosures about their exposure to the 2019 SolarWinds espionage attack, alleging they downplayed scope or framed known incidents as hypothetical risks. The companies cooperated and settled without admitting or denying the findings, while the SEC continues to tighten cyber incident disclosure obligations for public companies.