Securities class action
US legal procedure allowing a group of investors who suffered stock market losses to collectively sue a company and its officers for misrepresentation or omission of material information.
The securities class action rests on the Securities Exchange Act of 1934 and the Securities Act of 1933, and was heavily reformed by the Private Securities Litigation Reform Act of 1995. It governs collective investor suits against issuers and their officers. The typical claim is that the company made false statements, or failed to disclose material information. That distorted the market price, plaintiffs paid the distorted price, and they lost money when the correction came. Directors' personal exposure is direct, which makes D&O policies the central insurance instrument. Since the mid-2010s, cybersecurity has become fertile ground for class actions. When a data breach hits the stock price, shareholders allege that executives had publicly described the company's security as adequate without the means to back it up. Others claim the executives were slow to disclose the incident under SEC rules, notably the 2023 disclosure rule. The complaint the SEC filed in October 2023 against SolarWinds and its CISO marked a turning point by personally targeting a chief information security officer over public statements on cyber posture; the federal court in New York dismissed most of it on July 18, 2024, and the SEC dropped the rest in November 2025. For D&O insurers, this cyber-securities convergence produces large losses that historical limits may not absorb, and raises the question of how D&O and cyber policies interact.
Textbook case: following the disclosure of a data breach at a major US health insurer, the stock falls 22% in three days. A class action is filed two weeks later, alleging that the CEO and CFO had stated in the annual report that IT security was a strategic priority, while a classified internal audit had revealed unpatched vulnerabilities for two years. The D&O policy is invoked for defense costs and potential settlement.
- Hunton, "Judge Dismisses Most of SEC Case Against SolarWinds and its CISO", July 2024; Harvard Law School Forum on Corporate Governance, "SolarWinds Dismissed: What the SEC's U-turn Signals for Cyber Enforcement", December 7, 2025
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.