Since September 5, 2023 the SEC has required public companies to disclose within four days all cybersecurity breaches<\/a> that could impact their bottom lines. Apparently ALPHV is aware of the new rules and in this screenshot of the SEC complaint form it wrote:<\/p>\n \u201cWe want to bring to your attention a concerning issue regarding MeridianLink\u2019s compliance with the recently adopted cybersecurity incident disclosure rules.<\/p>\n It has come to our attention that MeridianLink, in light of a significant breach compromising customer data and operational information, has failed to file the requisite disclosure under Item 1.05 of Form 8-K within the stipulated four business days, as mandated by the new SEC rules.\u201d<\/p>\n<\/blockquote>\n The referenced item (Form 8-K Item 1.05) states:<\/p>\n \u201cRegistrants must disclose any cybersecurity incident they experience that is determined to be material, and describe the material aspects of its:<\/p>\n – Nature, scope, and timing; and<\/p>\n – Impact or reasonably likely impact.<\/p>\n An Item 1.05 Form 8-K must be filed within four business days of determining an incident was material. A registrant may delay filing as described below, if the United States Attorney General (\u201cAttorney General\u201d) determines immediate disclosure would pose a substantial risk to national security or public safety.<\/p>\n Registrants must amend a prior Item 1.05 Form 8-K to disclose any information called for in Item 1.05(a) that was not determined or was unavailable at the time of the initial Form 8-K filing. \u201c<\/p>\n<\/blockquote>\n As you can see, there are possible exceptions and for all we know, the investigation into the nature and gravity of the data breach is still ongoing. Or far from as material as ALPHV wants us to believe.<\/p>\n In a statement to databreaches.net<\/a> MeridianLink said:<\/p>\n \u201cSafeguarding our customers\u2019 and partners\u2019 information is something we take seriously. MeridianLink recently identified a cybersecurity incident that took place on Nov 10. Upon discovery on the same day, we acted immediately to contain the threat and engaged a team of third-party experts to investigate the incident. Based on our investigation to date, we have identified no evidence of unauthorized access to our production platforms, and the incident has caused minimal business interruption.<\/p>\n We have no further details to offer currently, as our investigation is ongoing.\u201d<\/p>\n<\/blockquote>\n Apparently the ransomware operators like to pretend that what they are doing is their civic duty. This tile is posted on the landing page of the gang’s leak site.<\/p>\n Clicking through, we found the screenshot of the form and a non-explanatory statement why they filled the form out.<\/p>\n \u201cDespite this requirement, MeridianLink has not fulfilled this obligation regarding the breach it experienced a week ago. We have therefore reported this non-compliance by MeridianLink, who was involved in a material breach impacting customer data and operational information, for failure to file the required disclosure with the Securities and Exchange Commission (SEC). It appears MeridianLink reached out, but we are yet to receive a message on their end. Maybe this was their DFIR, Mandiant, who did so without authorization from their client. Whatever the reason is\u2026..we are giving you 24 hours before we publish the data in its entirety.\u201d<\/p>\n<\/blockquote>\n Whatever the reason is behind MeridianLink\u2019s apparent decision not to report the cyber-incident (yet), the action taken by ALPHV certainly is something we haven\u2019t seen before. It may be a warning or an attempt to gain extra leverage. Knowing how hard it can be to determine the scope of a cyberattack in just a few days, we can expect to see this happen more often.<\/p>\n Our business solutions remove all remnants of ransomware and prevent you from getting reinfected. Want to learn more about how we can help protect your business? Get a free trial below.<\/p>\n![\"screenshot](\"https:\/\/www.malwarebytes.com\/wp-content\/uploads\/sites\/2\/2023\/11\/leaksite_3.png\")
<\/figure>\n\n
\n
\n
![\"ALPHV](\"https:\/\/www.malwarebytes.com\/wp-content\/uploads\/sites\/2\/2023\/11\/meridian-link-on-the-alphv-dark-web-site.jpg?w=1024\")
\n
![\"second](\"https:\/\/www.malwarebytes.com\/wp-content\/uploads\/sites\/2\/2023\/11\/laeaksite_2.png\")
<\/figure>\nHow to avoid ransomware<\/h2>\n
\n
\n