SEC Charges Four Companies With Misleading Cyber Disclosures

The Securities and Exchange Commission today charged four current and former public companies – Unisys Corp., Avaya Holdings Corp., Check Point Software Technologies Ltd, and Mimecast Limited – with making materially misleading disclosures regarding cybersecurity risks and intrusions. The SEC also charged Unisys with disclosure controls and procedures violations. The companies agreed to pay the following civil penalties to settle the SEC’s charges: Unisys will pay a $4 million civil penalty; Avaya. will pay a $1 million civil penalty; Check Point will pay a $995,000 civil penalty; and Mimecast will pay a $990,000 civil penalty. The charges against the four companies result from an investigation involving public companies potentially impacted by the compromise of SolarWinds’ Orion software and by other related activity.