Checkout.com Takes a Bold Stance, SolarWinds Case Dismissed, and FCC Reverses Mandate

Summary

Cybersecurity Today – Episode Summary

Episode Title:
Checkout.com Takes a Bold Stance, SolarWinds Case Dismissed, and FCC Reverses Mandate

Host:
David Shipley (sitting in for Jim Love)

Date:
November 24, 2025

---

Overview

This episode of Cybersecurity Today dives deep into the powerful interplay between technology, public policy, and business decisions shaping the current cybersecurity landscape. Host David Shipley covers three headline stories:

• Checkout.com refuses a ransom demand and supports cyber research instead.
• The SEC closes its landmark case against SolarWinds and its CISO.
• The FCC pulls back on a critical cybersecurity mandate, drawing fierce debate over America’s national security posture.

Throughout, Shipley emphasizes the importance of policy, leadership decisions, and the implications for organizations, executives, and practitioners in the field.

---

Key Discussion Points and Insights

1. Checkout.com’s Ransomware Response: Donate, Don’t Pay

[00:22 – 04:45]

• Breach Details:

  • Shiny Hunters, a known cyber extortion group, accessed an old (pre-2020) third-party cloud storage environment.
  • Stolen data included onboarding materials, operational docs, and merchant info.
  • The breach did not affect current production systems.

• The Ransom Demand:

  • Shiny Hunters demanded payment—Checkout.com refused outright.
  • Instead, the company publicly pledged to donate the equivalent of the ransom demand to Oxford and Carnegie Mellon to support cybersecurity research.

• Industry Implications:

  • Shipley praises this as a “bold, principled stance” and a “powerful signal” to customers, attackers, and the market.
  • He highlights increasing confidence among some organizations to refuse ransom payments—supported by improved incident response, legal clarity, and the ability to absorb breach fallout.

• Disputed Data on Ransom Payments:

  • Different analysts report diverging payment rates:
    • Coveware (Oct 2025): Only 23% of victims paid ransom in Q3; for data exfiltration-only attacks, just 19%.
    • SOPOS: Nearly half of surveyed retail organizations admitted to paying at least once in recent incidents.
  • “None of these numbers are wrong... but we’re not going to know the true global payment rate because most jurisdictions don’t require companies to report when they pay.” (Shipley, 03:27)

• Call for Policy Reform:

  • Shipley urges governments to mandate disclosure of ransom payments to better inform policy, risk, and defense planning.
  • “We can’t fix what we can’t measure.” (Shipley, 03:36)

• Lessons for Listeners:

  • Stay on top of legacy systems.
  • Audit third-party integrations.
  • Be prepared to consider refusing to pay a ransom as part of breach rehearsals.

---

2. SolarWinds and CISO Accountability: A Legal Turning Point

[04:45 – 08:25]

• Case Conclusion:

  • The SEC drops its high-profile civil case against SolarWinds and CISO Tim Brown after a joint motion.
  • The case had shaped global debate about cyber accountability post-2020 SolarWinds supply chain hack.

• Origins and Outcome:

  • SEC originally claimed SolarWinds misled investors about cyber risk and ignored internal warnings.
  • Most claims were tossed in 2024—judges ruled the SEC relied too heavily on hindsight and conflated cyber controls with financial controls.

• Enduring Industry Concerns:

  • SolarWinds’ CEO calls this the end of a challenging chapter.
  • Even with the dismissal, CISO personal liability remains a hot topic—underscored by other cases like Uber’s Joe Sullivan (probation, $50k fine).

• Broader Regulatory Context:

  • In Canada, Parliament is debating Bill C8—set to require mandatory cyber reporting by critical infrastructure and possibly expose execs to penalties.
  • Shipley—who testified on this in Ottawa—argues against individual CISO liability:
    • “If lawmakers want to continue to hold someone in an organization responsible... it should be corporate directors or CEOs... Otherwise, laws risk increasing the flight of experienced talent...” (Shipley, 07:58)

• Key Policy Point:

  • Vague or retrospective liability risks chilling transparency and discouraging effective incident response.
  • Legal requirements must align with organizational realities—otherwise, “we risk discouraging transparency rather than improving security outcomes.” (Shipley, 08:18)

---

3. FCC Reverses Cyber Mandate: National Security at Risk

[08:25 – 13:25]

• Mandate Withdrawn:

  • On Nov 19, the US FCC reversed its January 2025 ruling, which had mandated enhanced cyber controls for US telecoms under CALEA.
  • The original rule clarified telcos’ duty to secure both equipment and network operations, requiring risk management plans and annual certification.

• Reason for Reversal:

  • FCC (majority) claims previous rule “misconstrued CALEA” and was “unlawful and ineffective.”
  • Major US carriers argued they had already improved cyber postures voluntarily.

• Dissent and Criticism:

  • FCC Commissioner Anna Gomez (the sole dissent):
    • “Removing the requirements will leave Americans less protected than they were the day the Salt Typhoon breach was discovered.” (Gomez, 10:47)
  • Senator Maria Cantwell calls Salt Typhoon “one of the worst cyberattacks in US history” and labels the now-repealed mandate as “the only concrete federal regulatory action” taken in response.

• Salt Typhoon Recap:

  • A Chinese state-linked operation breached core US telecom systems, including wiretap infrastructure, geolocation data, and communications of senior officials—even affecting the president and vice president.
  • Many carriers still haven’t documented remediation of the exploited vulnerabilities.

• Policy Fallout:

  • Reversal is seen as a “pattern of weakness” on national security and risks a repeat of catastrophic attacks.

• Notable Quote:

  • “Critics of the reversal say that without clear cybersecurity requirements tied to CALEA obligations, the US lacks the regulatory backbone needed to prevent a repeat of Salt Typhoon.” (Shipley, 12:38)

---

4. Policy as the Battlefield: Technology, Law, and Leadership

[13:25 – 14:50]

• Central Thesis:

  • Cybersecurity is shaped as much by legislation and policy as by technology, tools, and operational decisions.
  • Decisions in boardrooms and SOCs matter, but so do those in legislatures and agencies.

• Call to the Community:

  • Shipley urges professionals to engage proactively with policymakers:
    • “Your expertise does matter. Your voice can and does help shape the legal systems and the infrastructure we all depend on.” (Shipley, 14:34)
  • Recounts volunteering at the BSides Ottawa Policy Village—educating tech pros on Canadian cyber, privacy, and digital law.

• Takeaway:

  • The cyber community must help lawmakers understand real-world impacts to avoid bad policy, overreaching or inadequate regulation, and national security gaps.
  • It’s not about politics, but about clarity, impact, and collective security.

---

Notable Quotes & Memorable Moments

• On Ransom Payment Reporting:

  • “We can’t fix what we can’t measure.”
    —David Shipley [03:36]

• On Corporate Resilience:

  • “While checkout.com didn’t avoid a breach, they avoided being controlled by the breach.”
    —David Shipley [03:47]

• On CISO Liability:

  • “If lawmakers want to continue to hold someone in an organization responsible for cyber actions or lack of action, it should be corporate directors or CEOs... Otherwise, laws risk increasing the flight of experienced talents that we need right now in our critical infrastructure sectors...”
    —David Shipley [07:58]

• On Regulatory Rollback:

  • “Removing the requirements will leave Americans less protected than they were the day the Salt Typhoon breach was discovered.”
    —FCC Commissioner Anna Gomez [10:47]

• On Professional Responsibility:

  • “We all can’t sit on the sidelines and just simply complain about bad laws or weak enforcement after the fact. We need to be in the room where these conversations are happening.”
    —David Shipley [14:23]

---

Key Timestamps

• 00:22 — Checkout.com breach recap & ransom refusal
• 03:36 — The critical need for mandatory ransom payment reporting
• 04:45 — SolarWinds/SEC legal case dismissal explained
• 07:58 — Advocacy against CISO personal liability
• 08:25 — FCC’s reversal of telecom cyber mandates
• 10:47 — Commissioner Gomez’s warning
• 12:38 — Critics’ warning: insufficient backbone for telecom security
• 13:25 — The fundamental role of public policy in cybersecurity
• 14:34 — Community engagement and calling for action

---

Conclusion

This episode underscores the profound influence of policy, leadership, and informed advocacy on cybersecurity outcomes. By examining case studies, legal battles, and regulatory shifts, Shipley calls on practitioners to step up—not just to defend networks and data, but to help shape the laws, standards, and frameworks on which everyone’s digital safety relies.

Transcript

[A]

Cybersecurity Today would like to thank Meter for their support in bringing you this podcast. Meter delivers a complete networking stack, wired, wireless and cellular in one integrated solution that's built for performance and scale. You can find them at meter.com CST.

[B]

Checkout.Com refuses to pay ransom, donates to research instead SEC walks away from case against solar winds and their CISO FCC bizarrely pushes undo on cyber standards for US telcos this is Cybersecurity Today and I'm your host David Shipley, back home in New Brunswick after a great visit last week to BSides Ottawa. Let's get started. UK fintech heavyweight checkout.com, a payments processor behind brands like Ikea, klarna, Samsung and HelloFresh, confirmed that the cyber extortion group Shiny Hunters accessed one of its old third party cloud storage systems, bleeping computer reports that this wasn't a production system breach, it was a legacy environment from 2020 and earlier. The stolen data included onboarding materials, operational documents and merchant information. Shiny Hunters came knocking, demanding a ransom. Checkout.com's answer? We're not going to pay. Instead, we're going to donate that money to Oxford and Carnegie Mellon to support cybersecurity research. That's a bold, principled stance, and it's an example of what can happen when a company has confidence in its instant response, solid legal footing and the capacity to weather the fallout of a breach. Checkout.com's move of not paying is one that some reports are saying is happening more and more. But accurately measuring ransom payment rates is exceptionally difficult. Different reports often produce very different numbers. For example, Coveware's most recent analysis from October 2025 showed only 23% of victims paid in Q3 2025, a historic low and part of what they say is a six year downward trend for data exfiltration only attacks, which now dominate the landscape. The payment rate drops to around 19%, they say. On the other hand, SOPOS recently had a different report with a different methodology. That said, nearly half of surveyed retail organizations admit to having paid at least one ransom in recent incidents. None of these numbers are wrong. They come from different organizations doing different studies with different data sources. And we're not going to know the true global payment rate because most jurisdictions don't require companies to report when they pay. That's a problem. Without accurate data, policymakers, insurers, and defenders are flying partially blind if governments want to further disrupt the ransomware economy and give organizations the confidence to do what checkout.com just did, then mandatory reporting of ransom payments should be on the table everywhere. We can't fix what we can't measure. While checkout.com didn't avoid a breach, they avoided being controlled by the breach. By refusing to pay and instead donating to cyber research, they flipped the often terrible narrative. Instead of funding criminals, they're funding the people who make criminals lives harder. That's a powerful signal to customers, to attackers, and to the market. And this story is a reminder to everyone listening. Make sure you're on top of legacy systems and retire out old things. When the time has come, audit your third party integrations and in your breach rehearsals, prepare for the possibility that refusing to pay is the right call the U.S. securities and Exchange Commission has formally ended its long running case against Solar Winds and their Chief Information Security Officer Tim Brown, a case that has shaped global conversations about cybersecurity accountability since the 2020 supply chain attack. In a joint motion filed Nov. 20, the SEC, SolarWinds and Brown asked a federal court to dismiss the lawsuit. The commission had originally alleged that SolarWinds misled investors about its cybersecurity posture and and ignored internal warnings prior to The Russian linked APT29 compromise. The hacker News reports that most of those allegations were significantly weakened last year. In July 2024, a US district court judge threw out the bulk of the SEC's claims against solar Winds, ruling they relied too heavily on hindsight and attempted to treat cybersecurity controls as if they were financial accounting controls, something the law did not support. What remained of the case continued for more than a year, but without those foundational claims, the SEC has now elected to walk away. The commission emphasized the decision does not necessarily end quote, reflect its stance on future cybersecurity related enforcement. SolarWinds CEO said the dismissal marks the end of a challenging chapter for the company, which has since invested significantly in strengthening its cybersecurity practices. While the Dismissal brings the SolarWinds story to a close, it lands amidst a broader environment where the questions around CISO accountability remain hotly debated. And this case follows years of scrutiny by executives about their personal liability, including high profile criminal cases such as the one involving Uber's CISO Joe Sullivan. Sullivan was sentenced to three years probation and a $50,000 fine in that criminal case. He appealed, but the case was upheld in March 2025. While SolarWinds was a civil case and Sullivan's was a criminal case, both shaped industry concern about how far regulators and prosecutors might go in holding security leaders personally responsible after major incidents. The Solar Winds dismissal may ease some of that pressure and by showing the limits of existing legal frameworks, but it does not eliminate the expectation that companies must provide accurate, timely and consistent disclosure about cybersecurity risk and incidents. Here in Canada, these developments come as Parliament considers Bill C8, legislation that would impose mandatory cybersecurity requirements and reporting on critical infrastructure sectors, and introduces the possibility of penalties that could touch individual executives. While C8 is still under active debate, the SolarWinds outcome highlights an important issue for lawmakers. If individual liability is contemplated, legal standards have to be clear and they have to be aligned with operational and organizational decision making reality. The US Cases show how ambiguous expectations, especially those based on hindsight, can make enforcement difficult, and they risk discouraging transparency rather than improving security outcomes. As Canada and other countries modernize their cybersecurity regulatory frameworks, these lessons will be important to consider and for full transparency. I've testified to an all party parliamentary committee on the previous bill to this bill C26 and I've consistently advocated against personal liability for CISOs. If lawmakers want to continue to hold someone in an organization responsible for cyber actions or lack of action, it should be corporate directors or CEOs, the folks who actually set organizational risk appetite and the budget. Otherwise, laws risk increasing the flight of experienced talents that we need right now in our critical infrastructure sectors more now than ever. With the onslaught of cyber threats thanks to increased geopolitical instability and the mass proliferation of hacking capability thanks to AI, now is not the time to be making CISO flight from the field. Worse, the U.S. federal Communications Commission has reversed one of the only federal cybersecurity mandates created in response to the sweeping SALT typhoon hacks, a decision that has drawn sharp criticism both inside and outside the agency and raised new questions about U.S. national security preparedness. On Wednesday, the FCC withdrew its January 2025 declaratory ruling that required U.S. telecommunications providers to adopt and certified enhanced cybersecurity measures. Those requirements had been issued under calea, the Communications Assistance for Law Enforcement act, which governs lawful intercept capabilities in telecom networks. The January ruling was significant because it formally clarified that telecom carriers are responsible for securing both their equipment and the way that they operate their networks, particularly against unlawful access and interception. It also included a proposed rulemaking that would have required carriers to build and maintain cybersecurity risk management plans and certify those plans annually. Last week's reversal nullified all of that. The commission said the earlier order misconstrued CALEA and called the previous framework unlawful and ineffective. According to The FCC months of engagement with major US carriers showed they had strengthened cybersecurity on their own and committed to additional urgent and coordinated efforts to protect their networks. Sure they did. The decision was not unanimous. FCC Commissioner Anna Gomez, the only commissioner to vote against the reversal, warned that removing the requirements, quote, will leave Americans less protected than they were the day the Salt Typhoon breach was discovered, end quote. Senator Maria Cantwell, who leads the Senate Commerce Committee, echoed those concerns, calling Salt Typhoon, quote, one of the worst cyber attacks in U.S. history and pointing out that the January ruling was, quote, the only concrete federal regulatory action, end quote, taken in response to those attacks. She also noted the reversal follows heavy lobbying by the same telecom providers compromised by Salt Typhoon. Given the scale of the damage over the last two years and the strategic importance of US telecommunications infrastructure, the Salt Typhoon operation attributed to a Chinese state sponsored threat actor, targeted core network systems at major carriers including AT&T T Mobile, Verizon, Lumen, Windstream and others. As a reminder, federal investigators say the attackers were able to access wiretape, access wiretap related systems used by US law enforcement, geolocate millions of Americans, intercept phone calls and even target high ranking government officials, including the President and Vice president. Officials warn the techniques used, especially the exploitation of telecom routers and trusted network interconnections, remain a risk. Critics of the reversal say that without clear cybersecurity requirements tied to CALEA obligations, the US lacks the regulatory backbone needed to prevent a repeat of Salt Typhoon. Senator Cantwell warned that the decision fits a pattern of weakness on national security issues, noting that some carriers have still yet to provide documentation on how they remediated vulnerabilities Salt Typhoon exploited. Commissioner Gomez put it plainly. Without strong federal controls, it is unlikely Salt Typhoon will be the last attack of its kind or the last successful attack of its kind. And that brings us to the bigger theme running throughout today's episode. You'll notice I spend a lot more time than usual talking about policy, about what governments decide, what regulators enforce, and how legal frameworks shape the incentives and pressures on organizations. There's a clear reason for that. Cybersecurity doesn't exist in a vacuum. It isn't just about firewalls, detection tools, vulnerabilities and patch cycles. It lives at the intersection of technology, economics, public safety and, yes, public policy. The checkout.com breach, the SolarWinds case and the FCC's reversal all point to the same reality. The decisions made in boardrooms and in SOCs matters, but the decisions made in legislatures, courts and regulatory agencies matter just as much, and in some cases more, as they drive organizational decisions. If rules are unclear, we get confusion instead of accountability. If incentives are wrong, we reward the wrong behaviors. And if lawmakers don't understand the technology, we end up with policy that either goes too far or not far enough. Or, in the case of the fcc, reversal undermines national security preparedness. As technology and security experts, we all can't sit on the sidelines and just simply complain about bad laws or weak enforcement after the fact. We need to be in the room where these conversations are happening and decisions are made. So to everyone listening, whether you're writing code, running a SoC, building tools, leading teams, your expertise does matter. Your voice can and does help shape the legal systems and the infrastructure we all depend on. That's why last week I was in Ottawa volunteering my time at the B Sides Policy Village to help educate the technology community about the state of Canada's cyber, digital and privacy laws. Because if we want better policy, we need more people in our community to understand what's happening and how to shape it. And I want to be really, really clear. This isn't about politics or taking partisan sides. It's about all of the people who make laws and policies, understanding the impact of their actions or non action. We are doing them and the broader world a favor, a service by helping to educate them. We're always interested in your feedback and you can contact [e-mail] or leave a comment under the YouTube video. Please help us spread the word about the show. Like subscribe or leave a review and if you enjoyed today's episode, tell others about it. We want to continue to grow our audience and we need your help. I've been your host David Shipley, Jim Love will be back on Wednesday.

[A]

Once again we'd like to thank Meter for their support in bringing you this podcast. Meter delivers full stack networking infrastructure, wired, wireless and cellular to leading enterprises and working with their partners, Meter Designs, deploys and manages everything required to get performant, reliable and secure connectivity in a space. They design the hardware, the firmware, build the software, manage deployments and run support. It's a single integrated solution that scales from branch offices, warehouses and large campuses all the way to data centers. You can book a [e-mail] CST that's M-E-T-E-R.com CST.