Cybersecurity firm SolarWinds Corp. ($SWI) filed its Form 10-K this week, giving analysts their latest glimpse into how much financial harm SolarWinds might suffer from its role in that massive cyber attack Russia launched on the U.S. government last year.

As you might recall, the feds discovered late last year that Russian operatives placed malware into the Orion Software Platform that SolarWinds sells to corporate and government customers. That maneuver allowed Russia to penetrate the cybersecurity defenses of a vast swath of the U.S. government and Corporate America; the president of Microsoft ($MSFT) called it “the largest and most sophisticated attack the world has ever seen.”

Calcbench previously looked at what SolarWinds had to say about the event in a blog post from December, when the business announced the attack on Dec. 14 in a Form 8-K filing. Now we have SolarWinds’ first quarterly report since everything went sideways, so let’s review the latest.

The company offered 590 words of disclosure related to the cyber attack, right at the top of the Commitments & Contingencies section in the 10-K. Most notable: in the 17 days from Dec. 14 (when SolarWinds first announced the attack) through Dec. 17 (the end of the filing period), SolarWinds racked up $3.5 million in expenses related to the attack.

For the record, SolarWinds also reported $1.02 billion in revenue for 2020 — so the attack expenses were only 0.34 percent of that number. Not a material amount per se, but the $3.5 million was incurred in only 17 days. Presumably the ongoing costs will be much higher as 2021 unfolds.

As SolarWinds proceeds to note, “As a result of the cyber Incident, we are subject to numerous lawsuits and investigations … In addition, there are underway numerous investigations and inquiries by domestic and foreign law enforcement and other governmental authorities related to the cyber Incident, including from the Department of Justice, the Securities and Exchange Commission, and various state Attorneys General.”

Translation: a whole lotta lawyers are coming after SolarWinds. Whatever the final costs of that litigation might be — and SolarWinds does not provide any estimate of that number — the process will not be cheap.

What Happens Next

SolarWinds did disclose that it maintains a $15 million insurance policy for cybersecurity attacks. Obviously that amount will help, but it’s unlikely to cover the full cost of things. (Nevermind the potential loss of business from customers too spooked to keep doing business with the firm.)

In that case, SolarWinds will likely need to set aside cash over time, placing it in a contingency account as the true cost of the cyber attack becomes more clear.

The good news is that the company does seem to have that money. For example, gross profit was $744.6 million in 2020; and operating profit after sales and marketing, R&D, and other routine expenses was still $107 million. See Figure 1, below.

On the balance sheet, we see that SolarWinds had $370.5 million in cash at the end of 2020, roughly 6.5 percent of $5.71 billion in total assets.

On the other hand, SolarWinds was also carrying $4.25 billion in goodwill. So if the firm suffers a loss of reputation in the market, which then translates into lower revenue or share price over the long-term — could that lead to a goodwill impairment? Which could, then, slash into stockholder equity since so much of the company’s total assets are tied up specifically in goodwill?

That’s only speculation on our part. We do know, however, that any hit to customer loyalty or revenue isn’t yet reflected in SolarWinds’ financial statements, because the attack happend so late into the company’s fiscal year. And while the company has seen a plunge in share price since December, when you look at the prior 12 months altogether (Figure 2, below), the plunge isn’t so bad.

What’s next? Check back with us in three months, or set SolarWinds as one of the firms you track with our email alerting function. Whenever there’s new data to study, rest assured that Calcbench has it.