SEC Fines Four Companies for Misleading Cybersecurity Disclosures

The U.S. Securities and Exchange Commission (SEC) has fined four companies - Unisys Corp., Avaya Holdings Corp., Check Point Software Technologies Ltd, and Mimecast Limited - for providing materially misleading disclosures regarding cybersecurity incidents. These settlements follow an investigation into public companies impacted by the SolarWinds Orion software compromise.

Unisys faces a $4 million penalty, Avaya $1 million, Check Point $995,000, and Mimecast $990,000, all related to their handling of cybersecurity disclosures. According to the SEC, these companies failed to provide accurate information about breaches, downplaying the extent of the incidents. "While public companies may become targets of cyberattacks, it is incumbent upon them to not further victimize their shareholders or other members of the investing public by providing misleading disclosures," said Sanjay Wadhwa, Acting Director of the SEC's Division of Enforcement.

The SEC's orders reveal that Unisys, Avaya, and Check Point learned of unauthorized access in 2020, while Mimecast became aware in 2021. Despite this knowledge, the companies provided misleading statements in their public disclosures, minimizing the impact of the breaches. The companies have neither admitted nor denied the SEC's findings but have agreed to cease future violations and pay the outlined penalties.