The SolarWinds headquarters are seen in Austin, Texas, Dec. 18, 2020.SERGIO FLORES/Reuters
Canada Pension Plan Investment Board agreed to buy a stake in SolarWinds Corp. (SWI-N) for US$315-million just days before the company disclosed it was the target of a major global hacking campaign that has compromised multiple U.S. computer systems.
“To say the timing is unfortunate is an understatement,” CPPIB spokesman Michel Leduc said Friday. “We continue to carefully look into this with the utmost diligence.”
SolarWinds said it learned of the data breach on Monday. The company said hackers inserted malicious code into software updates for Orion, its flagship network management software. SolarWinds sent Orion software updates to address the issue to nearly 18,000 customers, including the U.S. Treasury and Department of Commerce and a number of state and city governments.
Microsoft president Brad Smith said in a blog post that his company was hacked in connection with the same attack, and that Canada was also hit.
On an earnings call two months ago, SolarWinds chief executive officer Kevin Thompson touted the reach of his company’s software: “We don’t think anyone else in the market is really even close in terms of the breadth of coverage we have. We manage everyone’s network gear.”
The attack is widely believed to have been undertaken by Russians. U.S. officials have ordered anyone running Orion to immediately disconnect it. In a statement on Thursday, SolarWinds said it had not independently verified the identity of the attacker.
SolarWinds stock is down nearly 40 per cent this week, falling to Friday’s close of US$14.18 from US$23.55 on Dec. 11. The Dec. 9 announcement of CPPIB’s purchase of a roughly 5-per-cent stake in the company – made the same day SolarWinds named a new CEO – used the future tense in referring to the closing of the deal, suggesting it was not final.
A footnote to U.S. securities filings regarding the stock sale, which said the agreed-upon price was US$21.97 a share, also said it is “subject to potential adjustment under certain circumstances.”
Mr. Leduc declined to comment on the timing of the closing or on whether CPPIB has an opportunity to renegotiate the terms. SolarWinds’ public-relations staff did not respond to an e-mail.
Austin, Tex.-based SolarWinds was founded in 1999 and went public in 2018. CPPIB agreed to buy a small piece of a 42-per-cent stake in SolarWinds held by its two biggest shareholders – Thoma Bravo LLC and Silver Lake Management LLC.
Mr. Leduc refers to them as “long-standing, trusted, terrific partners.” CPPIB has often invested alongside Silver Lake and has put money into its funds. In 2009, CPPIB was part of a Silver Lake-led investment group that bought a majority stake in Skype Technologies SA from eBay Inc.
Mr. Leduc said, “We expect [SolarWinds] will continue to create exceptional value along our extended investment horizon.”
“Bad guys, nation-state or otherwise, are occasionally one step ahead of good guys when it comes to cyberattacks,” he said.
CPPIB had $456.7-billion in assets at Sept. 30.
With a report from Reuters
Your time is valuable. Have the Top Business Headlines newsletter conveniently delivered to your inbox in the morning or evening. Sign up today.
David Milstead