www.marketwatch.com Open in urlscan Pro
108.139.47.52  Public Scan

Form analysis
0 forms found in the DOM

Text Content

Skip to main content

Advertisement
Subscribe Now: US $1 for 4 Weeks
 * Home
 * Latest News
 * Watchlist
 * Market Data Center
    * U.S.
    * Cryptocurrency
    * Europe
    * Rates
    * Asia
    * Futures
    * Currencies

 * Markets
    * U.S. Markets
    * Canada
    * Europe & Middle East
    * Asia
    * Emerging Markets
    * Latin America
    * Market Data

 * Investing
    * Barron's
    * Best New Ideas
    * Stocks
    * IPOs
    * Mutual Funds
    * ETFs
    * Options
    * Bonds
    * Commodities
    * Currencies
    * Cryptocurrencies
    * Futures
    * Financial Adviser Center
    * Cannabis
    * Newswires

 * Barron's
 * Economy & Politics
    * Washington Watch
    * Coronavirus
    * Inflation
    * The Federal Reserve
    * Economic Report
    * U.S. Economic Calendar

 * Personal Finance
    * The Moneyist
    * Spending & Saving
    * Retirement
    * TaxWatch
    * Credit Cards
    * Careers
    * Travel
    * Real Estate
    * Real Estate Listings

 * Retirement
    * Best New Ideas in Retirement
    * Estate Planning
    * Help Me Retire
    * FIRE
    * Taxes
    * Social Security
    * Real Estate
    * Where Should I Retire
    * Best Places

 * How to Invest
 * Virtual Stock Exchange
 * Video
    * MarketWatch 25 Years
    * SectorWatch
    * The Moneyist
    * Getting to Work With
    * Explainomics
    * How to Invest
    * MarketBrief
    * Fire Starters
    * How Bad Is It
    * The Cost of Things
    * Office Hours
    * Best New Ideas in Money Festival
    * Mastering Your Money

 * Podcasts
 * Live Events
 * Opinion
 * Investor's Business Daily
    * Leaderboard
    * SwingTrader
    * MarketSmith
    * IBDLive

 * Newsletter Center
 * Research & Tools
    * Watchlist
    * Mortgage Calculator
    * Multiple Quotes Tool
    * Stock Screener
    * Earnings Calendar
    * Market Screener
    * IPO Calendar
    * Short Interest
    * Trending Tickers Screener
    * Premarket Screener
    * Options Expiration Calendar
    * After Hours Screener
    * Currency Tools
    * Mutual Fund Screener
    * Upgrades & Downgrades
    * Top 25 Mutual Funds
    * Mutual Fund Comparison
    * Economic Calendar
    * Where Should I Retire?
    * Retirement Planner
    * Top 25 ETFs

 * MarketWatch Picks
    * Loans
    * Money
    * Technology
    * Real Estate
    * Guides
    * Credit Cards
    * Banking
    * Lifestyle
    * Retirement

Sign Up Log In
 * Profile Settings
 * Watchlist
 * Email & Alerts
 * Games

MarketWatch Site Logo A link that brings you back to the homepage.
 * Latest
 * Watchlist
 * Markets
 * Investing
 * Personal Finance
 * Economy
 * Retirement
 * How to Invest
 * Video Center
 * Live Events
 * MarketWatch Picks
 * More
   Latest Watchlist Markets Investing Personal Finance Economy Retirement How to
   Invest Video Center Live Events MarketWatch Picks

Subscribe Now
 * Account Settings
 * Log In
 * Sign Up

Close Search Overlay


Advertisement

Advertisement

 1. Home
 2. Industries
 3. Software
 4. Associated Press


ASSOCIATED PRESS




SOLARWINDS FALLS UNDER SCRUTINY AFTER HACK, STOCK SALES

Last Updated: Dec. 16, 2020 at 7:47 p.m. ET First Published: Dec. 16, 2020 at
7:46 p.m. ET
By

ASSOCIATED PRESS

  comments


COMPANY’S 2 BIGGEST INVESTORS — SILVER LAKE AND THOMA BRAVO — SOLD MORE THAN
$280 MILLION IN STOCK DAYS BEFORE REVELATIONS

THE U.S. DEPARTMENT OF THE TREASURY IN WASHINGTON, WHICH WAS A VICTIM OF THE
HACK.

AFP/Getty Images
 * Email icon
 * Facebook icon
 * Twitter icon
 * Linkedin icon
 * Flipboard icon

 * Print icon
 * Resize icon


REFERENCED SYMBOLS


Advertisement
SWI
-0.46%

Before this week, few people were aware of SolarWinds, a Texas-based software
company providing vital computer network monitoring services to major
corporations and government agencies worldwide.

But the revelation that elite cyber spies have spent months secretly exploiting
SolarWinds’ software to peer into computer networks has put many of its
highest-profile customers in national governments and Fortune 500 companies on
high alert. And it’s raising questions about whether company insiders knew of
its security vulnerabilities as its biggest investors sold off stock.

Founded in 1999 by two brothers in Tulsa, Oklahoma, ahead of the feared
turn-of-the-millennium Y2K computer bug, the company’s website says its first
product “arrived on the scene to help IT pros quell everyone’s world-ending
fears.”


Advertisement

This time, its products are the ones instilling fears. The company on Sunday
began alerting about 33,000 of its customers that an “outside nation state” —
widely suspected to be Russia — injected malicious code into some updated
versions of its premier product, Orion. The ubiquitous software tool, which
helps organizations monitor the performance of their computer networks and
servers, had become an instrument for spies to steal information undetected.

“They’re not a household name the same way that Microsoft is. That’s because
their software sits in the back office,” said Rob Oliver, a research analyst at
Baird who has followed the company for years. “Workers could have spent their
whole career without hearing about SolarWinds. But I guarantee your IT
department will know about it.”

Now plenty of other people know about it, too. One of SolarWinds’ customers, the
prominent cybersecurity firm FireEye, was the first to detect the cyberespionage
operation, and began notifying other victims. Among other revealed spying
targets were the U.S. departments of Treasury and Commerce.

Now Playing: CPJ President on Efforts to Free WSJ Reporter Evan Gershkovich

1/1 Skip Ad Continue watching after the ad Visit Advertiser websiteGO TO PAGE

NEXT Off English 360p 720p HD 1080p HD Auto (720p) About Connatix V263049 About
Connatix V263049
Visit our Video Center
Advertisement

But the Trump administration has been silent on what other agencies were
breached. And that wasn’t sitting well with some members of Congress.

“Stunning,” tweeted Sen. Richard Blumenthal, a Connecticut Democrat. He said a
Senate Armed Services Committee classified briefing Tuesday “on Russia’s
cyberattack left me deeply alarmed, in fact downright scared. Americans deserve
to know what’s going on.”

“Declassify what’s known & unknown,” he demanded.

The Department of Homeland Security directed all federal agencies to remove the
compromised software on Sunday night and thousands of companies were expected to
do the same. The Pentagon said in a statement Wednesday that it had so far found
“no evidence of compromise” on its classified and unclassified networks from the
“evolving cyber incident.”



The NSA, DHS and FBI briefed the House Intelligence Committee Wednesday on what
was widely considered a serious intelligence failure, and Democratic Sen. Dick
Durbin told CNN “this is virtually a declaration of war by Russia on the United
States, and we should take that seriously.”

Among business sectors scrambling to protect their systems and assess potential
theft of information were the electric power industry, defense contractors and
telecommunications firms.


Advertisement

The breach took the air out of SolarWinds SWI, -0.46%, which is now based in the
hilly outskirts of Austin, Texas. The compromised product accounts for nearly
half the company’s annual revenue, which totaled $753.9 million over the first
nine months of this year. Its stock has plummeted 23% since the beginning of the
week.

Moody’s Investors Service said Wednesday it was looking to downgrade its rating
for the company, citing the “potential for reputational damage, material loss of
customers, a slowdown in business performance and high remediation and legal
costs.”

SolarWinds’ longtime CEO, Kevin Thompson, had months earlier indicated that he
would be leaving at the end of the year as the company explored spinning off one
of its divisions. The SolarWinds board appointed his replacement, current
PulseSecure CEO Sudhakar Ramakrishna, on Dec. 7, according to a financial
filing, a day before FireEye first publicly revealed the hack on its own system
and two days before the change of CEOs was announced.

It was also on Dec. 7 that the company’s two biggest investors, Silver Lake and
Thoma Bravo, which control a majority stake in the publicly traded company, sold
more than $280 million in stock to a Canadian public pension fund. The two
private equity firms in a joint statement said they “were not aware of this
potential cyberattack” at the time they sold the stock. FireEye FEYE disclosed
the next day that it had been breached.


Advertisement

The hacking operation began at least as early as March when SolarWinds customers
who installed updates to their Orion software were unknowingly welcoming hidden
malicious code that could give intruders the same view of their corporate
network that in-house IT crews have. FireEye described the malware’s dizzying
capabilities — from initially lying dormant up to two weeks, to hiding in plain
sight by masquerading its reconnaissance forays as Orion activity.

FireEye said Wednesday that it had identified a “killswitch” that prevents the
malware used by the hackers from operating. But while that disables the original
backdoor, it won’t remove intruders from systems where they created different
ways of remotely accessing victimized networks.

SolarWinds executives declined interviews through a spokesperson, who cited an
ongoing investigation into the hacking operation that involves the FBI and other
agencies.

Thompson’s last few weeks at the helm are likely to be spent responding to
frightened customers, some of them rankled about marketing tactics that might
have made a target of SolarWinds and its highest-profile clients.

The company earlier this week took down a web page that boasted of dozens of its
best-known customers, from the White House, Pentagon and the Secret Service to
the McDonald’s restaurant chain and Smithsonian museums. The Associated Press is
among customers, though the news agency said it did not use the compromised
Orion products.

SolarWinds estimated in a financial filing that about 18,000 customers had
installed the compromised software. And while that made them vulnerable to spy
operations, security experts say its unlikely the hackers penetrated the vast
majority. Spies tend to have narrow interest in such operations. Dozens of
“high-value targets” in government and industry were compromised, said FireEye,
without naming them. It said it has confirmed infections in North America,
Europe, Asia and the Middle East to governments, consulting firms and the health
care, technology, telecommunications and oil and gas industries — and has been
informing affected organizations around the world.

Stanford University cybersecurity expert Alex Stamos said there aren’t nearly
enough qualified threat hunters globally to scour potentially infected
organizations for hidden malware from the operation.

“We are going to be reaping an ‘iron harvest’ of second-stage malware for years
from this one,” he tweeted, a reference to unexploded World War II bombs that
continue to be found in Europe three-quarters of century later.


Advertisement

PARTNER CENTER


Advertisement

Advertisement

Advertisement

Advertisement

MOST POPULAR


Advertisement

AMERICANS’ PERSONAL SAVINGS JUST HIT $1 TRILLION. WHAT’S THE BEST PLACE TO STORE
YOUR CASH — CDS, I-BONDS OR ONLINE SAVINGS ACCOUNTS?

‘I’M IN A NO-MAN’S-LAND’: I’M 75, SELLING MY HOME AND MOVING OVERSEAS. WHERE DO
I GO — AND HOW DO I INVEST THE $350K FROM THE SALE?

‘SOMETHING SNAPPED INSIDE HIM’: MY CONTRACTOR BOYFRIEND OF 2 YEARS DUMPED ME. HE
SAID I WAS USING HIM TO FIX UP MY HOUSE.

HOW TO AVOID TAXES LEGALLY

NEWELL BRANDS PRESIDENT ADDRESSES ELEPHANT IN THE ROOM: BED BATH & BEYOND


Advertisement


Advertisement


READ NEXT


READ NEXT


BARRON'S: ARTIFICIAL INTELLIGENCE IS DRIVING THE STOCK MARKET. IT HAS SOME
ADVICE FOR YOU.

Artificial intelligence like Microsoft-powered ChatGPT is a primary reason
stocks up this year. As a result, stock market is being powered by the narrowest
stock leadership since the 1990s.


MORE ON MARKETWATCH

 * Here’s how much money the 2023 NFL draft picks will earn on their rookie
   contracts
 * Bed Bath & Beyond requests withdrawal of filing for share offering
 * Barron's: Big Pension Exited First Republic Stock, Bought AMC and DR Horton
 * Meme stock TOP Financial Group soars more than 890%, spurred on by the Reddit
   crowd

Community Guidelines • FAQs



ADVERTISEMENT




ADVERTISEMENT



Back to Top
Copyright © 2023 MarketWatch, Inc. All rights reserved.
Subscriber Agreement & Terms of Use | Privacy Notice | Cookie Notice
 * Facebook
 * Twitter
 * Linkedin
 * 

 * MARKETWATCH

 * Customer Center
 * Contact Us
 * Newsroom Roster
 * Virtual Stock Exchange
 * BigCharts
 * Copyright Policy
 * Manage Notifications
 * Cancel My Subscription

 * COMPANY

 * Dow Jones
 * Code of Conduct
 * Corrections
 * Reprints & Licensing
 * Digital Self Service
 * Your Ad Choices
 * Corporate Subscriptions
 * Accessibility

 * DOW JONES NETWORK

 * The Wall Street Journal
 * Barron's
 * Financial News London
 * realtor.com
 * Mansion Global

Intraday Data provided by FACTSET and subject to terms of use. Historical and
current end-of-day data provided by FACTSET. All quotes are in local exchange
time. Real-time last sale data for U.S. stock quotes reflect trades reported
through Nasdaq only. Intraday data delayed at least 15 minutes or per exchange
requirements.



Search Clear

Search
Advanced Search

Advertisement


SEARCH RESULTS

All News
Articles
Video
Podcasts






AUTHORS




SECTIONS




COLUMNS




SYMBOLS




PRIVATE COMPANIES




RECENTLY VIEWED TICKERS


NO RECENT TICKERS

Visit a quote page and your recently viewed tickers will be displayed here.

Search Tickers




No results found

No results found