Ubiquiti, Inc. (UI) Made Misstatements Regarding the Severity of its Data Breach
On January 11, 2021, Ubiquiti issued a public notice stating that it had become aware of “unauthorized access to certain of our information technology systems hosted by a third party cloud provider.” The notice indicated that the Company had no “evidence of access to any databases that host user data, but we cannot be certain that user data has not been exposed.” On February 5, 2021, Ubiquiti filed its quarterly report on Form 10-Q for the period ended December 31, 2020, which again noted that ‘in January 2021, we became aware that certain of our information technology systems hosted by a third party cloud provider were improperly accessed and certain of our service code and the credentials used to access the information technology systems themselves had been compromised.”
These statements failed to disclose to shareholders that: (i) the Company had downplayed the data breach in January 2021; (2) attackers had obtained administrative access to Ubiquiti’s servers and obtained access to all databases, all user database credentials, and secrets required to forge single sign-on (SSO) cookies; (3) as a result, intruders already had credentials needed to remotely access Ubiquiti’s customers’ systems; and (4) as a result, defendants’ positive statements about the Company’s business, operations, and prospects were materially misleading and/or lacked a reasonable basis.
On March 30, 2021, Krebs on Security published an article entitled “Whistleblower: Ubiquiti Breach ‘Catastrophic'” stating that the Company had downplayed the data breach and that the “third-party cloud provider claim was a fabrication.” According to a Company whistleblower, Ubiquiti “had been aware since December 2020 that hackers had administrative access to all Ubiquiti AWS accounts, including … all user database credentials, and secrets required to forge single sign-on (SSO) cookies.” On this news, the Company’s stock price fell $50.70, or over 14%, to close at $298.80 per share on March 31, 2021.
If you purchased shares of Ubiquiti, Inc. (UI) January 11, 2021 and March 30, 2021, you have until July 19, 2021, to ask the court to appoint you lead plaintiff for the class.
All representation is on a contingency fee basis. Shareholders pay no fees or expenses.
