After taking into account the company's cooperation and remediation, the SEC imposed a $995,000 penalty. Mimecast Mimecast Ltd. provides cloud security and risk management services for email and corporate information to approximately 40,000 customers. The SEC order against Mimecast found that the company "negligently made materially misleading misstatements" in its January and March 2021 Form 8-K disclosures regarding a cyberattack discovered in January 2021 by the same threat actor involved in the SolarWinds Orion compromise. These statements to investors minimized the attack by failing to disclose the nature of the code that the threat actor exfiltrated and the quantity of encrypted credentials accessed.