Both Avaya and Mimecast publicly disclosed the cybersecurity incidents that they experienced. The SEC does not claim that these disclosures contained a materially false representation. Rather, similar to the unsuccessful arguments it made in the SolarWinds case, the SEC alleges that the disclosures contained material omissions.