View all newsletters
Receive our newsletter - data, insights and analysis delivered to you
  1. Technology
  2. Cybersecurity
November 16, 2023

BlackCat hacks company, reports victim to SEC

The Russian ransomware gang has complained to the regulator that MeridianLink failed to disclose the cybersecurity incident in good time.

By Greg Noone

Ransomware gang BlackCat has filed a complaint with the US financial regulator the Securities and Exchange Commission (SEC) against one of its own victims for failing to report a breach. The move appears to be a ploy to make the company involved, MeridianLink, comply with a ransom demand. 

According to the filing, MeridianLink – which supplies digital lending solutions to banks, credit unions and other financial institutions – failed to act in line with US law by notifying the regulator that the group had hacked it earlier this month. 

Also known as ALPHV, BlackCat has been one of the most active ransomware gangs in 2023, and previous alleged victims include Reddit, watchmaker Seiko and the Ecuadorian Army. This appears to be the first time it has complained about a victim’s misconduct to regulators.

An exterior shot of the US Securities and Exchange Commission.
Last month the US Securities and Exchange Commission passed new rules that would force firms to disclose material cybersecurity incidents. (Photo by Tada Images/Shutterstock)

BlackCat goes to the SEC

In a statement to DataBreaches, BlackCat explained that they had exfiltrated files from MeridianLink on 7 November. The breach seems to have passed unnoticed by the firm’s security staff until the gang posted the company to its victim blog, at which point “they… patched the way used to get in” to the firm’s systems. 

BlackCat then reported its own attack to the SEC. The gang complained to the regulator that MeridianLink had “failed to file the requisite disclosure under Item 1.05 of Form 8-K with[in] the stipulated four business days, as mandated by the new SEC rules”.

The regulations cited by BlackCat were announced by the SEC last month and require companies operating in the US to disclose data breaches and other material cybersecurity incidents within four business days. While the ransomware gang did comply with the spirit of the new rules by letting this grace period expire before it reported MeridianLink, it seems to have overlooked that the legislation does not officially come into force until 15 December.

MeridianLink has confirmed a “cybersecurity incident” took place on 10 November, three days after BlackCat claimed to have breached its systems. It did not say whether a ransom demand had been issued or paid.

Content from our partners
<strong>Powering AI’s potential: turning promise into reality</strong>
Unlocking growth through hybrid cloud: 5 key takeaways
How businesses can safeguard themselves on the cyber frontline

A company spokesperson said it “acted immediately to contain the threat and engaged a team of third-party experts to investigate the incident”.

The spokesperson added: “Based on our investigation to date, we have identified no evidence of unauthorised access to our production platforms, and the incident has caused minimal business interruption. We have no further details to offer currently, as our investigation is ongoing.” 

It was inevitable that cybercriminal groups would begin to use data breach notification requirements to exert added pressure on their victims to pay ransoms more promptly, explains Dr Ilia Kolochenko, the CEO of cybersecurity firm ImmuniWeb. “Having said that, not all security incidents are data breaches, and not all data breaches are reportable data breaches,” Kolochenko told Tech Monitor. “Therefore, regulatory agencies and authorities should carefully scrutinize such reports and probably even establish a new rule to ignore reports uncorroborated with trustworthy evidence. Otherwise, exaggerated or even completely false complaints will flood their systems with noise and paralyze their work.”

This is not the first time that a cybercrime gang has claimed to report its victims to regulators for failing to disclose breaches in good time. RansomedVC recently said that it threatened companies who failed to pay ransoms for stolen data with GDPR complaints (data breaches under the EU regulation can lead to fines of €20m or 4% of a firm’s annual global turnover.) However, this strategy has since been discontinued with the gang’s voluntary liquidation as of 30 October. According to a statement made by RansomedVC’s alleged admin, “I do not want to continue being monitored by federal agencies and I would wish to sell the project to someone who will want to continue it.”

Read more: Will generative AI really supercharge phishing attacks?

Websites in our network
Select and enter your corporate email address Tech Monitor's research, insight and analysis examines the frontiers of digital transformation to help tech leaders navigate the future. Our Changelog newsletter delivers our best work to your inbox every week.
  • CIO
  • CTO
  • CISO
  • CSO
  • CFO
  • CDO
  • CEO
  • Architect Founder
  • MD
  • Director
  • Manager
  • Other
Visit our privacy policy for more information about our services, how Progressive Media Investments may use, process and share your personal data, including information on your rights in respect of your personal data and how you can unsubscribe from future marketing communications. Our services are intended for corporate subscribers and you warrant that the email address submitted is your corporate email address.