SEC Charges Public Companies with Misleading Cybersecurity Disclosures

On October 22, 2024, the Securities and Exchange Commission (SEC) announced that four companies were charged with making misleading disclosures about cybersecurity risks and intrusions. One company faced additional charges related to disclosure controls and procedures violations. It’s important to note that these charges were based on conduct that occurred before the new cybersecurity disclosure rules came into effect in 2023.

The allegations by the SEC stated that the companies’ public disclosures downplayed the seriousness of the SolarWinds cyberattack-related intrusions. These companies were accused of various shortcomings in their disclosures, including describing risks as hypothetical even after they had materialized, providing generic descriptions of cyber risks without detailing specific incidents, withholding information about the extent of data accessed, and minimizing the impact of the breaches. As a result of these charges, the companies agreed to pay civil penalties ranging from $990,000 to $4,000,000.

This enforcement action by the SEC underscores the importance of accurate and comprehensive disclosures by public companies, especially when it comes to cybersecurity incidents. It’s crucial for companies to ensure that their disclosures, including those related to cybersecurity incidents, are detailed and reflect all material information. While the dissenting SEC commissioners raised concerns about the review process and the potential for excessive disclosure of immaterial details, companies should remain vigilant in updating their risk factor disclosures, revising existing cybersecurity disclosures, and enhancing their disclosure controls and procedures.

In light of these developments and the upcoming changes in the SEC administration, companies should stay informed about evolving enforcement approaches related to cybersecurity incident disclosures. If you have any questions or concerns about what you should disclose, Husch Blackwell’s Securities & Corporate Governance team is available to provide guidance and support. Feel free to reach out to Craig Adoor, Steve Barrett, Robert Joseph, Victoria Sitz, Andrew Spector, Annorah Harris, or your Husch Blackwell attorney for assistance.