> In an unusual disclosure for any public company ... We experienced unauthorized intrusions into our network between 2011 and 2018 Seems like the author is tr

> In an unusual disclosure for any public company ... We experienced unauthorized intrusions into our network between 2011 and 2018 Seems like the author is trying to create drama where there isn't any, here. Is that an unusual disclosure given that it was made in 2019? I know very little about this subject having never worked (at least directly) in financials/compliance. I've participated in various parts of these things (mostly centered around IT SOX compliance about a decade ago). Something I recall about those days, though, was to "err on the side of disclosure". The game was always "The Department doesn't want to say (this thing) but the auditors want us to[0]". Even if it was based on very little, it's better to explain it than have it come up in a lawsuit. By 2019, this Supermicro story was considered "fact" despite there being enough questions as to call the whole thing into question. The disclosure, from my perspective, served to help the company in two ways: (1) Whatever Supermicro's official position about "being breached" up to that point were, they weren't clear. Whether or not upper management's official position was "we were breached/we were not breached" is irrelevant. In a lawsuit, discovery would likely turn up piles of e-mail from people far down the chain speculating on a breach in a manner that implies "the organization knew all along!" So they've put it to bed "we've been breached" is the official position. That's the starting point of "moving on"... (2) Assuming it's true, they've now answered the question -- for customer's who took their business elsewhere -- is it safe to do business with Supermicro? Apparently a lot of people still think so because "None of these intrusions, individually or in the aggregate, has had a material adverse effect on our business, operations, or products." Perhaps it's an unusual disclosure, but you could say the same about a good chunk of the disclosures we ended up putting together during compliance. [0] "The thing" was always some reporting artifact that appeared to indicate a serious financial issue but was easily normalized -- i.e. an unexpected domain controller was added, an artifact of our reporting caused devices that logged in via that DC to report two of every license required, causing an $40 million gap in the budget. Tweak a SQL query and it's fixed, add the DC to the knowns and it's fixed, but spending an hour arguing why the original, wrong, report should not be disclosed was often the next required step.