SEC drops SolarWinds lawsuit

By Emma Woollacott for IT PRO
Monday, November 24, 2025

• 5.6k
• More

The case has now been dropped altogether, as the SEC said it had taken the decision "in the exercise of its discretion" and that it did not necessarily reflect the Commission's position on any other case.

"For obvious reasons, the SEC did not want to take a risk in this highly publicized and closely watched case, instead preserving its resources for upcoming lawsuits where it can prevail in court with certainty," said Ilia Kolochenko, CEO at ImmuniWeb and vice chair of the American Bar Association's Information Security Committee.

"In sum, one should be prepared for new legal actions by the SEC that may lead to major victories of the federal agency."

There was potential for the case to be a turning point in the cybersecurity industry. A moment that could have set a precedent for the liability of individual executives in the event of a cyber incident.

However, according to Kolochenko, cybersecurity professionals and executives shouldn't get the idea that the risk of personal liability for data breaches has vanished.

"While the 2025 federal enforcement policy in the US is rather innovation and technology friendly, it does not mean that, for example, the FTC or FCC will turn a blind eye to major data protection violations by private corporations," he said.

"The SEC has likewise made it crystal clear that it will not stop exercising its policing rights, while being much better prepared after its SolarWinds experience."

He added that there's always the possibility of private lawsuits from aggrieved investors or even victims of data breaches: "In sum, cybersecurity community should stay prudent and vigilant; the new litigation era is just starting." Read Full Article