Black Cat ransomware files SEC complaint, leveraging new rules to extort victim company MeridianLink, raising concerns about regulatory abuse.
In a bizarre twist of events, the notorious Black Cat/ALPHV ransomware group has taken an unexpected step in their cyber extortion tactics. According to a report by Bleeping Computer, the group filed a complaint with the U.S. Securities and Exchange Commission (SEC), alleging that one of their victims, a software company named MeridianLink, Inc., failed to disclose a cyberattack within the mandated four-day period.
MeridianLink, a publicly traded company that provides digital solutions to financial organizations, was reportedly listed on Black Cat's data leak site. The ransomware group threatened to leak stolen data unless a ransom was paid within 24 hours. However, when MeridianLink did not respond to their demands, Black Cat escalated the situation by leveraging the SEC's new public cyber disclosure rule in an extortion attempt.
Black Cat's complaint to the SEC is not just a mere threat; it's a strategic move that capitalizes on the recent adoption of SEC rules requiring public companies to disclose material cybersecurity incidents within four business days. The ransomware group claims that MeridianLink failed to report a significant breach affecting customer data and operational information.
To add credibility to their claim, Black Cat published a screenshot of the form they allegedly submitted on the SEC's Tips, Complaints, and Referrals page, alongside the SEC's acknowledgment of receiving the complaint.
This incident raises several concerns:
1. Abuse of Regulatory Process: The ransomware group's maneuver to use regulatory requirements for extortion highlights a potential misuse of government processes in cybercriminal activities.
2. The Challenge of New SEC Rules: Set to take effect on December 15, 2023, the SEC's cybersecurity rules demand timely disclosure of incidents. However, this situation illustrates the potential complications and unintended consequences of such regulations.
3. Industry Pushback: The industry has expressed concerns about the rigidity of the new rules, fearing early disclosures could lead to revictimization and interfere with forensic investigations.
4. Government Obligations and Unintended Results: This development underscores the complex interplay between government reporting obligations and the realities of cybersecurity threats.
As we navigate these uncharted waters, it's crucial for regulatory bodies like the SEC and victim companies to find a balance between compliance and safeguarding against such exploitative tactics. The hope is that the SEC will stand firm against such misuse of its processes and continue to support victims of cyberattacks.
The Black Cat/ALPHV's complaint to the SEC is a stark reminder of the evolving landscape of cybersecurity threats and the intricate challenges they pose to regulatory frameworks and corporate governance. As cybercriminals become more sophisticated, so must our strategies to combat and mitigate these threats.
