SolarWinds breach (2020): SUNBURST in Orion updates, and how the SEC case ended
SolarWinds makes IT monitoring software, including the Orion platform and Security Event Manager, its SIEM. In 2020 attackers got inside its build process and shipped a backdoor to customers in signed Orion updates. It became the reference case for software supply-chain attacks, and later for the first SEC fraud case against a sitting CISO. This is the record of what SolarWinds, CISA, the US government and the court actually said.
Short answer
Was SolarWinds hacked?
Yes. In December 2020 SolarWinds disclosed in an SEC Form 8-K that its Orion monitoring software updates released between March and June 2020 contained a vulnerability inserted by an outside attacker, and that “fewer than 18,000” customers may have installed an affected version. It notified about 33,000 Orion customers. The backdoor became known as SUNBURST.
SolarWinds later said the earliest suspicious activity on its systems was in September 2019, and that the malicious code was inserted into Orion releases from 20 February 2020. On 15 April 2021 the US government attributed the campaign with “high confidence” to Russia’s Foreign Intelligence Service (SVR), also tracked as APT29. The SEC charged SolarWinds and its CISO in October 2023; a judge dismissed most claims in July 2024, and the SEC dropped the rest of the case, with prejudice, on 20 November 2025.
Timeline at a glance
Sep 2019Earliest suspicious activity on SolarWinds’ internal systems, per its later investigation. (SolarWinds blog)Confirmed
20 Feb 2020SUNBURST code starts being inserted into Orion Platform releases; removed from SolarWinds’ environment in June 2020. (SolarWinds blog)Confirmed
13 Dec 2020CISA Emergency Directive 21-01 orders agencies to disconnect affected Orion versions. (CISA ED 21-01)Confirmed
14 Dec 2020SolarWinds 8-K: fewer than 18,000 customers may have installed the trojanised updates. (SEC 8-K)Confirmed
15 Apr 2021US government attributes the campaign to Russia’s SVR (APT29) with “high confidence”. (CyberScoop)Confirmed
30 Oct 2023SEC charges SolarWinds and CISO Timothy Brown with fraud and internal control failures. (SEC 2023-227)Confirmed
18 Jul 2024Court dismisses most SEC claims; only claims about the website Security Statement survive. (Hunton)Confirmed
20 Nov 2025SEC dismisses the remaining case against SolarWinds and Brown with prejudice. (Covington)Confirmed
Last updated 1 November 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.
SolarWinds incident timeline, in detail
Confirmed = acknowledged by SolarWinds, a regulator filing or a court. Reported = credible reporting SolarWinds has not fully confirmed. Unverified claim = an attacker or leak-site claim.
Sep 2019 – Dec 2020ConfirmedSoftware supply chain / build-system compromise
SUNBURST: a backdoor shipped to customers in signed Orion updates
What happened. SolarWinds’ 14 December 2020 Form 8-K said a vulnerability had been inserted into Orion updates released between March and June 2020, that it had notified about 33,000 Orion customers, and that it estimated “fewer than 18,000” had an installation containing the vulnerability. It also said an attack vector was used to compromise its Microsoft Office 365 email, with no evidence of exfiltration found at that time. In January 2021 SolarWinds said the earliest suspicious activity on its systems was in September 2019, the October 2019 Orion release carried test modifications, SUNBURST was inserted into releases from 20 February 2020, and the attackers removed it from its environment in June 2020. SolarWinds said it was told of the attack on 12 December 2020.
Impact. CISA’s Emergency Directive 21-01 (13 December 2020) ordered US federal civilian agencies to disconnect or power down Orion versions 2019.4 through 2020.2.1 HF1; later guidance narrowed the affected list to five versions and required at least 2020.2.1 HF2 for continued use. Installing the update gave the attackers a possible foothold; the 8-K’s figure is an estimate of installations, not of organisations the attackers went on to exploit. The US government attributed the campaign to Russia’s SVR on 15 April 2021, and the UK NCSC called that “highly likely”.
Oct 2023 – Nov 2025ConfirmedRegulatory action / securities fraud case
SEC v. SolarWinds and its CISO: charged, mostly dismissed, then dropped
What happened. On 30 October 2023 the SEC charged SolarWinds and CISO Timothy G. Brown with fraud and internal control failures, alleging that from the October 2018 IPO until the December 2020 disclosure the company described only generic risks while knowing of specific security weaknesses. It cited internal material including a 2018 engineer’s presentation calling the remote access set-up “not very secure”. On 18 July 2024 Judge Paul Engelmayer (S.D.N.Y.) dismissed most claims, including those about SEC filings, the post-attack 8-Ks and internal accounting controls, but let fraud claims about the company’s website Security Statement proceed. The parties told the court on 2 July 2025 they had reached a settlement in principle.
Impact. On 20 November 2025 the SEC dismissed the remaining claims against SolarWinds and Brown with prejudice. No penalty or admission was reported. The SEC said the decision “does not necessarily reflect the Commission’s position on any other case.” It was the first SEC cybersecurity enforcement action against an individual CISO.
Scope: “fewer than 18,000” is SolarWinds’ estimate of customers who may have installed an affected update, not the number the attackers went on to exploit. The 8-K gave no figure for follow-on intrusions, and we do not quote one here.
Affected versions: CISA’s original directive listed Orion 2019.4 through 2020.2.1 HF1; its January 2021 guidance narrowed that to five specific builds. Use the later list.
SEC case: the July 2024 ruling and the November 2025 dismissal ended the case without a finding either way. Neither SolarWinds nor Brown admitted the SEC’s allegations, and the court never ruled on the surviving claims’ merits.
The pattern across the record
The build system was the target
The attackers did not need a bug in Orion. They changed what SolarWinds’ own build produced, so customers received a correctly signed update carrying a backdoor. Code signing proved where the update came from, not that it was clean.
Monitoring tools hold the keys
Orion, like a SIEM, sits inside the network with broad credentials and outbound connectivity. Compromising one monitoring vendor gave access to the environments it watched.
Separate product bugs are not this breach
SolarWinds has also had product vulnerabilities exploited in the wild, such as Serv-U (CVE-2021-35211) and Web Help Desk (CVE-2024-28986), both added to CISA’s Known Exploited Vulnerabilities catalogue. Those were customer-side bugs, not a compromise of SolarWinds itself.
What it means for SolarWinds customers — and what to do
If you run SolarWinds Orion or Security Event Manager, the lesson is to treat the monitoring platform as one of the most privileged systems you own.
1.Confirm you are off the affected builds
Check any Orion install against CISA’s narrowed list of affected versions; anything that ever ran one should have been rebuilt, not just upgraded.
Allow outbound traffic only to known update and licensing hosts and alert on anything else, as CISA’s later guidance required for agencies that kept running Orion.
Yes. SolarWinds disclosed in December 2020 that attackers had inserted malicious code, later called SUNBURST, into Orion updates released between March and June 2020. It said fewer than 18,000 customers may have installed an affected version.
Who was behind the SolarWinds hack?+
On 15 April 2021 the US government attributed it with “high confidence” to Russia’s Foreign Intelligence Service (SVR), also tracked as APT29 or Cozy Bear. The UK NCSC said it was “highly likely”.
How did the SolarWinds attack work?+
Attackers got into SolarWinds’ build environment and inserted code into Orion releases from 20 February 2020, so customers received signed updates carrying a backdoor. SolarWinds said the earliest suspicious activity was in September 2019.
What happened to the SEC case against SolarWinds?+
The SEC charged SolarWinds and CISO Timothy Brown in October 2023. In July 2024 a judge dismissed most claims, leaving only those about the website Security Statement. The SEC dismissed the rest with prejudice on 20 November 2025, with no penalty reported.
Is SolarWinds safe to use now?+
The SUNBURST builds were withdrawn in 2020. Like any monitoring tool, SolarWinds products still need patching: separate product vulnerabilities, such as in Serv-U and Web Help Desk, have been exploited and listed by CISA. Keep it on current versions and restrict its network access.
More in the Breach Index
Same sourced, verification-tagged timeline, company by company — compare how peers have fared.
Independent analysis for security-leadership education; not affiliated with or endorsed by SolarWinds. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.
🖤 Black Friday: new customers get 3 months of Pro for $5, then $5/month. Ends 30 Nov. Claim 3 months for $5 →