Ransomware gang files SEC complaint over victim’s undisclosed breach

Zephyr_p/ShutterStock (Licensed)

Ransomware gang files complaint with SEC complaining victim didn’t promptly announce breach

The cybercrime gang claims its victim 'has not fulfilled' their obligation to report the breach.


Mikael Thalen


Posted on Nov 16, 2023   Updated on Dec 19, 2023, 8:55 am CST

A notorious ransomware group filed a complaint with the U.S. Securities and Exchange Commission (SEC) after one of its alleged victims reportedly failed to disclose their breach.

Featured Video Hide

In a post to the dark web on Wednesday, ALPHV, the cybercrime gang also referred to as BlackCat, claimed it hacked the software company MeridianLink and threatened to make its data public unless a ransom was paid.

Advertisement Hide

That same day, ALPHV took its coercion one step further by announcing that it alerted the SEC to the breach. ALPHV cited new SEC rules that require publicly traded companies to report cyberattacks within four days.

But the new rules, as noted by Reuters, don’t go into effect until Dec. 15. The initial breach of MeridianLink, according to comments given to DataBreaches.net by an ALPHV representative, took place on Nov. 7.

ALPHV further stated that MeridianLink appears to have reached out, “but we are yet to receive a message on their end” to discuss whether a payment will be made to stop the leak of data.

Advertisement Hide

Numerous screenshots of the FEC portal where the complaint was made were also shared by ALPHV.

“The recent adoption of SEC rules mandates public companies to promptly disclose material cybersecurity incidents under Item 1.05 of Form 8-K within four business days of determining such incidents to be material,” the group wrote on its blog. “Despite this requirement, MeridianLink has not fulfilled this obligation regarding the breach it experienced a week ago.”

While many have called the move unprecedented, Brett Callow, threat analyst for the cybersecurity firm Emsisoft, notes that at least one other ransomware group claimed it would do the same in the past.

Advertisement Hide

In remarks to the Daily Dot, Callow argued that ALPHV’s tactic was unlikely to convince MeridianLink to pay any ransom.

“This was a miscalculation by ALPHV. It’ll not make companies more likely to pay, but it may make them more likely to comply—especially after the Sullivan case,” Callow said.

The Sullivan case refers to the conviction earlier this year of former Uber CSO Joseph Sullivan, who was sentenced to three years probation after concealing a ransomware attack against the company in 2016 while it was under investigation by the Federal Trade Commission. 

Advertisement Hide

“Execs likely wouldn’t want ALPHV to be able to hold a failure to report over their heads as it’d open the door to a second round of extortion,” Callow added.

As of now, it remains unclear if ALPHV will release the alleged data. In a statement to DataBreaches.net, MeridianLink did confirm that it had “identified a cybersecurity incident” but claimed it had “identified no evidence of unauthorized access to our production platforms.”

An investigation by MeridianLink into the purported breach is ongoing.

We crawl the web so you don’t have to.
Sign up for the Daily Dot newsletter to get the best and worst of the internet in your inbox every day.
Sign up now for free
Share this article
*First Published: Nov 16, 2023, 12:51 pm CST
Exit mobile version