The massive data breach of the United States Commerce and Treasury Departments that has roiled the federal government has resulted in federal securities litigation. On January 4, 2021, Plaintiff-Shareholder Timothy Bremer filed a class action complaint against SolarWinds and SolarWinds’ corporate executives in the United States District Court for the Western District of Texas. SolarWinds provides information technology and infrastructure management software products to entities around the globe, including to various U.S. government vendors in the executive branch, military, and intelligence services. According to the complaint, Russian hackers gained access to government email traffic by deceptively interfering with software updates released by SolarWinds. The complaint alleges that SolarWinds violated federal securities law by making false and/or misleading statements and failing to disclose material facts regarding SolarWinds’ cybersecurity practices and protocols, which artificially inflated the market price of SolarWinds’ shares. When news of the hack became public, the value of Solarwinds’ securities dropped, thereby producing an economic loss for investors within the class period of February 24, 2020 through December 15, 2020. The complaint asserts claims for violations of Section 10(b) of the Securities Exchange Act of 1934 (the “Exchange Act”) and Rule 10b-5 against SolarWinds and its corporate executives, and for violations of Section 20(a) of the Exchange Act against the corporate executives.

The Delaware Supreme Court yesterday rejected a presumption of confidentiality for documents produced pursuant to books-and-records inspection requests under § 220 of the Delaware General Corporation Law.  The decision in Tiger v. Boast Apparel, Inc. (Del. Aug. 7, 2019) holds that courts can impose confidentiality restrictions in appropriate cases, but that some justification of confidentiality is necessary – and that an indefinite period of confidentiality should be the exception, not the rule.

In light of the emphasis that the Delaware Supreme Court has placed on § 220 requests particularly in the context of shareholder derivative actions, parties making and receiving those requests might now need to focus more closely on whether and the extent to which confidentiality restrictions can be justified and, if so, how long they should last.