August 2026 – The Securities and Exchange Commission has issued a whistleblower award, completing its $4 million case against Unisys relating to a nation-state cyberattack and Unisys’s response. The cyberattack that Unisys identified in its network involved a version of SolarWinds Orion software, likely carried out by a nation-state threat actor.  Upon investigation, the SEC found that the attack compromised seven network credentials and 34 cloud-based accounts. In October of 2024, the SEC issued an Order instituting Cease and Desist Proceedings and, in its findings, concluded that Unisys had filed annual reports on Form 10-K for 2020 and 2021 that included cybersecurity risk disclosures that were materially misleading. The SEC stated, “In these disclosures, Unisys inaccurately described the existence of successful intrusions and the risk of unauthorized access to data and information in hypothetical terms, despite knowing that the above-described intrusions had actually happened and in fact involved unauthorized access and exfiltration of confidential and/or proprietary information.” See SEC Order, https://www.sec.gov/files/litigation/admin/2024/33-11323.pdf.   

According to the SEC document in 2024, the SEC ordered Unisys to pay $4 million to the agency. The whistleblower payment was made recently. “The whistleblower in this case displayed courage, determination, and extensive knowledge of cyber intrusions against US companies by state actors. If more insiders would come forward to reveal these harmful and damaging acts, and our corporations encouraged employees to come forward and reveal these attacks, more of the attackers would be traced and caught,” said Attorney Newman. Jeff Newman Law worked the case with the assistance of Jordan Thomas of SEC Whistleblower Advocates.

Jeff Newman Law is a national whistleblower law firm handling SEC whistleblower cases as well as False Claims Act cases. The firm can be reached at www.JeffNewmanLaw.com or at 617-823-3217.