The story
History
SolarWinds began in 1999 in Tulsa, Oklahoma, co-founded by brothers Donald Yonce (a former executive at Walmart) and David Yonce. SolarWinds released its first products, Trace Route and Ping Sweep, earlier in March 1998 and released its first web-based network performance monitoring application in November 2001. In 2006, the company moved its headquarters to Austin, Texas, where about 300 of the company's total 450 employees were based as of 2011. The company was profitable from its founding through its IPO in 2009.
During 2007, SolarWinds raised funding from Austin Ventures, Bain Capital, and Insight Venture Partners. SolarWinds completed an initial public offering of US$112.5 million in May 2009, closing at higher prices after its initial day of trading. The IPO from SolarWinds was followed by another from OpenTable (an online restaurant-reservation service), which was perceived to break a dry spell during the Great Recession, when very few companies went public. Both Bain Capital and Insight Venture Partners backed the IPO and used the opportunity to sell some of their shares during the offering.
Analysts and company executives anticipated continued expansion post-IPO, including several acquisitions. In 2010, Bennett retired as CEO and was replaced by the company's former chief financial officer Kevin Thompson. In May 2013, SolarWinds announced plans to invest in an operations hub in Salt Lake City, Utah. It was named by Forbes as "Best Small Company in America, citing high-functioning products for low costs and impressive company growth." By 2013, SolarWinds employed about 900 people.
Acquisition by private equity technology investment firms Silver Lake Partners and Thoma Bravo, LLC. was announced in late 2015, and by January 2016, SolarWinds was taken private in a $4.5 billion deal. At the time, the company had 1,770 employees worldwide with 510 based in Austin, and reported revenues of about half a billion dollars a year.
In November 2017, SolarWinds released AppOptics which integrates much of its software portfolio, including Librato and TraceView, into a single software-as-a-service package. AppOptics included compatibility with Amazon Web Services and Microsoft Azure.
In September 2018, SolarWinds filed for a public offering again, after three years of being owned by private equity firms. SolarWinds completed its public offering on October 19, 2018.
On December 7, 2020, CEO Kevin Thompson retired, to be replaced by Sudhakar Ramakrishna, CEO of Pulse Secure, effective January 4, 2021.
On January 8, 2021, the company hired former CISA director Chris Krebs to help the company work through the recent cyber attack.
Read the full text
In July 2021, SolarWinds separated its managed service provider (MSP) business from the main company. The new separately-traded public company is named N-able.
In February 2025, the company announced that it would be acquired by private equity firm Turn/River Capital for $4.4 billion; the deal received approval from Thoma Bravo and Silver Lake, SolarWinds' majority shareholders with a combined 65% of the outstanding voting securities. The deal was closed on April 18, 2025 for $18.50 per share and the company delisted from the New York Stock Exchange.
2019–2020 supply chain attacks
SUNBURST
On December 13, 2020, The Washington Post reported that multiple government agencies were breached through SolarWinds's Orion software. The next day, the company stated in an SEC filing that fewer than 18,000 of its 33,000 Orion customers were affected, involving certain hotfixes of versions 2019.4 through 2020.2.1, released between March 2020 and June 2020. According to Microsoft, hackers acquired superuser access to SAML token-signing certificates. This SAML certificate was then used to forge new tokens to allow hackers trusted and highly privileged access to networks. The Cybersecurity and Infrastructure Security Agency issued Emergency Directive 21–01 in response to the incident, advising all federal civilian agencies to disable Orion.
APT29, aka Cozy Bear, working for the Russian Foreign Intelligence Service (SVR), was reported to be behind the 2020 attack. Victims of this attack include the cybersecurity firm FireEye, the US Treasury Department, the US Department of Commerce's National Telecommunications and Information Administration, as well as the US Department of Homeland Security. Prominent international SolarWinds customers investigating whether they were impacted include the North Atlantic Treaty Organization (NATO), the European Parliament, UK Government Communications Headquarters, the UK Ministry of Defence, the UK National Health Service (NHS), the UK Home Office, and AstraZeneca. FireEye reported the hackers inserted "malicious code into legitimate software updates for the Orion software that allow an attacker remote access into the victim's environment" and that they have found "indications of compromise dating back to the spring of 2020". FireEye named the malware SUNBURST. Microsoft called it Solorigate.
The attack used a backdoor in a SolarWinds library; when an update to SolarWinds occurred, the malicious attack would go unnoticed due to the trusted certificate. In November 2019, a security researcher notified SolarWinds that credentials to a third party FTP server had a weak password of "solarwinds123", warning that "any hacker could upload malicious [code]" that would then be distributed to SolarWinds customers. The New York Times reported SolarWinds did not employ a chief information security officer and that employee passwords had been posted on GitHub in 2019.
On December 15, 2020, SolarWinds reported the breach to the Securities and Exchange Commission. However, SolarWinds continued to distribute malware-infected updates, and did not immediately revoke the compromised digital certificate used to sign them.
On December 16, 2020, German IT news portal Heise.de reported that SolarWinds had for some time been encouraging customers to disable anti-malware tools before installing SolarWinds products.
On December 17, 2020, SolarWinds said it would revoke the compromised certificates by December 21, 2020.
On December 21, 2020, Attorney General William Barr stated that he believed that the SolarWinds hack appears to have been perpetrated by Russia, contradicting speculations by President Donald Trump that China, not Russia, might be to blame.
In late December 2020, Trustwave, a cybersecurity firm, reached out to SolarWinds to report new security flaws they had discovered in software produced by SolarWinds. Although these vulnerabilities hadn't been taken advantage of by hackers, it raised questions concerning the network security of SolarWinds' customers.
The magnitude of the monetary damage has yet to be calculated, but on January 14, 2021, CRN.com reported that the attack could cost cyber insurance firms at least $90 million.
On March 1, 2021, SolarWinds CEO, Sudhakar Ramakrishna, blamed a company intern for using an insecure password ("solarwinds123") on its update server. Speculation that this led to the attack is discounted by the company and security professionals. More than the intern using a weak password, experts noted that the main issue this fact highlights is the poor security culture the company has.
In the aftermath of the incident there has been question raised within the US Government about the role Microsoft carried out in enabling the breach. This relates to the "golden SAML" vulnerability in Microsoft's directory offerings that the company had knowledge of but did not address. Senator Ron Wyden questioned why the US Government spent so much money on Microsoft software without the company warning it of this hacking technique.
SUPERNOVA
On December 19, 2020, Microsoft said that its investigations into supply chain attacks at SolarWinds had found evidence of an attempted supply chain attack distinct from the attack in which SUNBURST malware was inserted into Orion binaries (see previous section). This second attack has been dubbed SUPERNOVA.
Security researchers from Palo Alto Networks said the SUPERNOVA malware was implemented stealthily. SUPERNOVA comprises a very small number of changes to the Orion source code, implementing a web shell that acts as a remote access tool. The shell is assembled in-memory during SUPERNOVA execution, thus minimizing its forensic footprint.
Unlike SUNBURST, SUPERNOVA does not possess a digital signature. This is among the reasons why it is thought to have originated with a different group than the one responsible for SUNBURST.
Insider trading claims
SolarWinds's share price fell 25% within days of the SUNBURST breach becoming public knowledge, and 40% within a week. Insiders at the company had sold approximately $280 million in stock shortly before this became publicly known, which was months after the attack had started. A spokesperson said that those who sold the stock had not been aware of the breach at the time.
Microsoft guidance on service provider and downstream business attacks
In November 2021, Microsoft issued an alert in relation to the advanced persistent threat (APT) actor Nobelium (aka APT29; Cozy Bear) that was responsible for the 2020 SolarWinds supply chain attack is targeting cloud service providers (CSPs), managed service providers (MSPs), and other IT service providers. Microsoft Threat Intelligence Center (MSTIC) released a range of recommendations for service providers and downstream businesses to implement in order to address the threat.
Lawsuits
In January 2021, a class action lawsuit was filed against SolarWinds in relation to its security failures and subsequent fall in share price. SolarWinds attempted to have this case dismissed; in March 2022, a judge ruled that the class action lawsuit could move forward. SolarWinds settled the suit for $26 million in November 2022, and was notified by the SEC that it intended to take enforcement action. The SEC sued SolarWinds in October 2023, however, the case was dropped in November 2025.
From Wikipedia’s article on SolarWinds, shared under CC BY-SA 4.0.6