New York City District Council of Carpenters Pension Fund v. SolarWinds Corporation

Court: United States District Court for the Western District of Texas
Case Number: 1:21-cv-00138
Class Period: 10/18/2018 - 12/17/2020
Case Leaders: John Rizio-Hamilton, Hannah Ross, Jonathan D. Uslaner
Case Team: Will Horowitz, Thomas Sperber

Based in Austin, Texas, SolarWinds provides software products used to monitor the health and performance of information technology networks. The Company’s flagship product is its Orion platform, which provides a suite of software tools widely used by government agencies and Fortune 500 companies to monitor their networks.

From October 18, 2018 to December 17, 2020 (the “Class Period”), SolarWinds touted its robust security controls and commitment to prioritizing customers’ security. In reality, however, the Company failed to employ adequate cybersecurity safeguards and did not maintain effective monitoring systems to detect and neutralize security breaches, prioritizing short-term profits while cutting security costs. As a result of vulnerabilities in the Company’s cybersecurity protections, SolarWinds and its customers were particularly susceptible to cyber-attacks. These misrepresentations caused shares of SolarWinds stock to trade at artificially inflated prices during the Class Period.

The truth began to be revealed on December 13, 2020, when Reuters reported that hackers had infiltrated the networks of the U.S. Treasury and Commerce departments and had been spying on the agencies’ internal email communications. The report further revealed that the hackers had gained access to the networks by tampering with software updates released by SolarWinds.

The next day, SolarWinds disclosed that hackers had breached its network and inserted malware into its Orion monitoring products, which existed in software updates released to SolarWinds customers between March and June 2020. The Company further revealed that the networks of as many as 18,000 customers may have been compromised by the malicious Orion updates.

On December 15, 2020, Reuters reported that, in 2019, a security researcher had warned SolarWinds that anyone could access the Company’s update server by simply using the password “solarwinds123.” Thus, the SolarWinds breach “could have been done by any attacker, easily.” Another cybersecurity expert observed that the Orion updates that contained the malicious code were still available for download days after the Company realized its software had been compromised.

Then, on December 17, 2020, Bloomberg News reported that the networks of at least three state governments were compromised as a result of the SolarWinds security breach. In addition, it was reported that the hackers used the SolarWinds intrusion to penetrate government networks that implicated national security concerns, including the U.S. Department of Energy and its National Nuclear Security Administration, which maintains the country’s arsenal of nuclear weapons. All told, these disclosures caused a precipitous decline in the price of SolarWinds shares, erasing over $620 million in shareholder value.

On February 9, 2021, the New York City District Council of Carpenters Pension Fund (“Lead Plaintiff”), represented by BLB&G, filed a securities class action against SolarWinds, certain of its current and former senior executives, and certain private equity companies that controlled SolarWinds during the Class Period. On June 1, 2021, Lead Plaintiff filed the Consolidated Complaint. Defendants moved to dismiss the Consolidated Complaint on August 2, 2021. On March 30, 2022, the Honorable Robert Pitman denied Defendants’ motions to dismiss in large part, and sustained nearly all of the Complaint. The case is now in discovery.

The parties engaged in mediation on October 26, 2022, which resulted in a successful mediation of the Action for $26 million, subject to the Court’s approval.