Unisys, Avaya, Check Point, and Mimecast will each pay civil penalties to settle the agency’s charges that they downplayed the impacts of the hack through their respective public disclosures. The Securities and Exchange Commission fined four companies on Tuesday with misleading investors about the impact the 2020 hack of SolarWinds had on their own systems.

The SEC concluded that four tech companies misled investors and minimized the damage they suffered from the SolarWinds supply chain hack.

The companies include IT security firm Check Point and email security provider Mimecast, which were ensnared in the SolarWinds breach four years ago.

SEC charges four companies for misleading disclosures regarding the SolarWinds cyberattack, imposing fines totaling $6 million.

The agency said Unisys, Avaya Holdings, Check Point Software Technologies and Mimecast provided misleading disclosures about the incidents, leaving investors in the dark about their "true scope."

The agency alleged Unisys, Avaya, Check Point Software and Mimecast misled investors about the extent of their respective cyber risks.

The SEC charged four major companies for misleading disclosures about cybersecurity risks and breaches, including SolarWinds attack. Companies will pay fines and improve cybersecurity practices.

The SEC believes that Mimecast did not provide investors with the full picture of the impact of the SolarWinds’ Orion hack on its systems.