In October 2024 the SEC charged Unisys, Avaya, Check Point and Mimecast over how they described intrusions linked to the SolarWinds Orion compromise. The common thread is that describing a risk as hypothetical, or an incident in generic terms, is misleading when the company already knows what happened.
The four cases
The SEC's release lists these penalties, each settled without admitting or denying the findings:
- Unisys, 4 million dollars, plus a separate charge for disclosure controls and procedures violations.
- Avaya, 1 million dollars.
- Check Point, 995,000 dollars.
- Mimecast, 990,000 dollars.
Unisys, Avaya and Check Point learned in 2020 that the actor likely behind the SolarWinds hack had accessed their systems. Mimecast learned in 2021.
What each was told it got wrong
Unisys described cyber risks as hypothetical even though it had two related intrusions that exfiltrated gigabytes of data, and the SEC tied this partly to deficient disclosure controls.
Avaya said the actor accessed a limited number of its email messages, while the SEC found it knew the actor had also accessed at least 145 files in its cloud file sharing environment.
Check Point knew of the intrusion but described it and related risks in generic terms.
Mimecast did not disclose the nature of the code the actor took or the number of encrypted credentials accessed.
What this means for drafting
Risk factor language is written in advance, but it must be checked against events. If a risk has already happened, saying it might happen is a problem. A quick test: for every sentence about a cyber risk, ask whether anything like it has occurred, and if yes, say so accurately.
Scope statements need the same care. "A limited number" is only accurate if the count and the other places touched were also checked.
A review habit for security and legal together
- Keep a living log of security incidents and near misses.
- Before each periodic filing, have security compare the log with risk language.
- For any incident, record both what was taken and where, including cloud storage and credentials.
- Escalate anything involving source code, credentials or customer data.
Where a security team can help
Good disclosure depends on good inventory of what an intruder could reach. Safeguard's asset discovery, compliance and evidence automation can support that record. Decisions about materiality and wording belong with counsel.
A before and after example
Weak wording says a breach could expose customer data. Better wording, if something has happened, says that an unauthorized party accessed certain systems in a given period, describes the categories of data involved, and states what is still under investigation. The second version is longer and less comfortable, but it matches the facts. Have counsel confirm the final text for your situation.
Quick check
Did the SEC say these companies caused the SolarWinds compromise?
No. The cases concern how they disclosed their own related intrusions.
Is generic wording always a violation?
The SEC alleged it was misleading in these cases because the companies knew specific facts. Ask counsel how the standard applies to you.
Sources
Last reviewed: 19 October 2026.
