Delaware Chancery Court Rejects Caremark Liability for Failure to Oversee Cybersecurity Risk: Court Classifies Cybersecurity Risk as a Business Risk for SolarWinds; Oversight of Business Risk, Even if “Mission Critical,” Analyzed Under Business Judgment Rule, Not Caremark Standard

Sullivan & Cromwell LLP - September 19, 2022

On September 6, 2022, the Delaware Chancery Court granted a motion to dismiss a derivative suit against directors of SolarWinds Corporation for allegedly breaching their fiduciary duty of loyalty by failing to oversee the company’s cybersecurity risk, which, plaintiffs claimed, resulted in a major compromise of software produced by the company in 2020. The court found that plaintiffs failed to plead sufficiently particularized facts from which to infer bad faith on the part of directors to support their failure of oversight claim. In doing so, the court emphasized both the limited circumstances in which such claims may survive a motion to dismiss, and the importance of board oversight of cybersecurity.

Subscribe to our Memos