Suing Victims over Cyber Attacks

Monday of this week, in a Texas Federal court, SolarWinds sought to have dismissed a shareholder suit alleging that the company tricked investors by not disclosing in advance company vulnerability to cyber attacks of its software product Orion.  Plaintiffs claimed SolarWinds misled investors by not warning them of the risk; the company replied that there was no suggestion of an intent to mislead, nor of recklessness (which would be the legal equivalent of intent), pointing out that the SolarWinds hack has been generally recognized as highly sophisticated.

The company does make a general observation about the direction of litigation that is worthy of note: any time something bad happens to a public company, a class action is filed against the company for a securities law misstatement harming stockholders.

Interestingly, plaintiffs also claimed against two PE firms because those firms held a large stake in SolarWinds equity.  Seemingly, the PE firms were major investors but not involved in operations.  We do not know all the facts, but mere stockholdings, however large the holdings, better not create liability for actions of the company (absent actual exercise of management control) or else the legal separation between investors and the company in which they invest will be destroyed by mere stock ownership.  That is not the current law,  today the “veil is not pierced” by stock ownership alone, and any change in the law in this regard would have massive market, litigation and insurance consequences.

Finally, while law firms that bring shareholder derivative suits under the securities laws are the traffic cops of the market-place and sometimes do uncover problematic action, the addition of ancillary defendants in litigation, to increase the chances of monetary recovery even on a nuisance suit basis, is unfortunate.

Comments are closed.