Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
SolarWinds’ reported incident expenses continued for years after the 2020 Orion software compromise, but the figures are not a bill for the entire breach. The company’s filings include technical investigation and remediation as well as legal work, customer support and settlement costs; they do not total the costs borne by affected government agencies and other organizations. Meanwhile, government response reviews, regulatory inquiries and lawsuits tracked different aspects of the incident—not a single count of how many networks were compromised.
What the SolarWinds breach involved
The compromise involved malicious code inserted into updates for SolarWinds Orion, software used by federal agencies to monitor network activity and manage network devices. The Government Accountability Office (GAO) reported that the federal government confirmed the threat actor as Russia’s Foreign Intelligence Service and that the intrusion into SolarWinds’ network began as early as January 2019. Compromised updates enabled access to networks at several agencies.
Downloading an affected Orion build is not the same as an attacker accessing a customer’s network, and network access is not necessarily proof that data was taken. Those are distinct events; the number of downloads should not be presented as the number of confirmed intrusions or data thefts.
What the investigations and oversight examined
Federal incident coordination
The federal Cyber Unified Coordination Group brought together the Cybersecurity and Infrastructure Security Agency (CISA), the FBI and the Office of the Director of National Intelligence, with support from the National Security Agency. CISA issued emergency response direction, while agencies shared guidance and tools. GAO later found that coordination and engagement with private-sector organizations helped make the response more efficient. It also identified slow information sharing and evidence-collection constraints tied to differing data-preservation practices.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Agency-specific response and oversight
The Department of Justice (DOJ) said its Office of the Chief Information Officer learned on December 24, 2020, of malicious activity involving the department’s Microsoft O365 email environment. DOJ said it eliminated the identified access method and assessed that around 3% of mailboxes were potentially accessed. It reported no indication that classified systems were affected. The department’s wording describes a potential exposure assessment, not a definitive count of compromised mailboxes.
The SEC Office of Inspector General’s August 3, 2021 management letter reviewed the Securities and Exchange Commission’s compliance with CISA Emergency Directive 21-01 and the commission’s initial response. A separate Department of Homeland Security Office of Inspector General report in March 2023 found that CISA had improved its ability to detect and mitigate risks after the breach, while identifying limitations in backup communications, staffing and secure workspace.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
SolarWinds’ own investigation
In a February 2021 update, SolarWinds said it had not determined the exact date attackers first gained access to its network. The company reported that one email account was compromised and used to programmatically access accounts belonging to targeted SolarWinds personnel. That was an early company investigation update, not a final independent determination.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteHow SolarWinds’ reported expenses changed
The amounts below are SolarWinds’ company-reported expenses for the stated reporting year, as described in its filings. They cover more than technical cleanup. The 2024 Form 10-K says incident expenses included investigation and remediation, lawsuits and investigations (including settlement costs), legal and professional services, customer consulting provided without charge, and estimated loss contingencies.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
| Reporting year | SolarWinds-reported amount | What the figure means |
|---|---|---|
| 2020 | $3.5 million pretax expenses | Through December 31, 2020; included investigation and remediation, legal and other professional services, and no-charge customer consulting. The filing’s figure is pretax, not an all-victims cost estimate. |
| 2021 | $49.1 million gross expenses | For 2021; SolarWinds said the gross expenses were partially offset by $15.0 million in received and expected insurance proceeds. The filing did not present that $15.0 million as a final net-cost figure. |
| 2022 | $56.435 million gross; $26.233 million net expenses | For 2022, as reported in SolarWinds’ 2024 filing. Gross expenses and net expenses reflect different insurance treatment. |
| 2023 | $17.714 million gross expenses; $2.084 million net benefit | For 2023, as reported in SolarWinds’ 2024 filing. After insurance proceeds, SolarWinds reported a net benefit rather than net expenses. |
| 2024 | $10.256 million gross and net expenses | For 2024, as reported in the company’s 2024 filing. |
These are successive annual figures, not a complete accounting of economic harm from the breach. They describe SolarWinds’ accounting, with differing gross, net and insurance presentations; they do not establish the total expenses of federal agencies, other customers or the private sector. The figures also should not be added to separate settlement payments without checking whether the filing already includes those costs.
The securities settlement and insurance
SolarWinds said it paid $26 million in March 2023 to fund a securities class action settlement and that directors’ and officers’ insurance fully reimbursed that payment. The company’s 2024 filing also includes lawsuits and settlement costs within its incident-expense description. The settlement payment is therefore part of the legal-cost story, not an amount to add automatically on top of reported incident expenses.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How the regulatory and legal timeline developed
- August 3, 2021: The SEC Office of Inspector General issued a management letter on the SEC’s initial response and compliance with CISA Emergency Directive 21-01.
- 2021: SolarWinds described multiple lawsuits and inquiries, including matters involving the DOJ, SEC and state attorneys general.
- October 2023: The SEC filed a civil complaint against SolarWinds and its chief information security officer.
- July 2024: SolarWinds’ 2024 Form 10-K said the court dismissed most of the SEC complaint, while one claim concerning the accuracy of the company’s online Security Statement remained pending at the time of the filing. That is the company’s account of the litigation at that point, not an independent finding about whether the statement was accurate.
- November 24, 2025: ITPro reported that the SEC had abandoned its lawsuit against SolarWinds and its security chief. That later report is secondary, and the available information here does not establish the dismissal’s terms from a court docket or official SEC record. It should not be treated as a docket-verified current status.
The sequence shows why “number of investigations” can be misleading without specifying what is being counted. Federal incident response, inspector-general reviews, company investigations, regulatory inquiries and civil litigation are separate processes with different mandates. They do not amount to a single tally of confirmed compromises.
Recommended Free Tools
Quick Recap
What the record establishes—and what it does not
- The compromise exploited trust in Orion software updates, but an affected download alone does not establish that a customer’s network was accessed.
- Federal agencies coordinated through a multi-agency group; GAO found both response benefits and problems with information sharing and evidence preservation.
- SolarWinds’ reported expenses include legal and customer-related costs as well as technical work. The cited filings do not provide a combined total for all affected organizations.
- Insurance materially changes gross-versus-net reporting. Settlement funding should not be counted again without confirming how it is treated in the annual expense figures.
- Oversight found stronger CISA detection and mitigation capability alongside gaps in backup communications, staffing and secure space.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
