A hacking group adopted a surprising strategy after infiltrating the network of a financial software company. They reported the breach to the US Securities and Exchange Commission (SEC).
DataBreaches.net The incident was initially reported on by ALPHV/BlackCat, a group known for breaching entities as diverse as MGM Resorts and Reddit. Hackers reportedly broke into the servers of fintech company MeridianLink on November 7 and stole the company’s data without encrypting it. However, when the business neglected to negotiate directly, the hackers increased the pressure by filing a report with the SEC.
He did so by citing a new rule passed by the SEC this summer, which requires companies that fall victim to “physical cybersecurity incidents” to report them to the agency within four business days.
However, the four-day requirement has not yet gone into effect. At least one official form claims that the rules were implemented 90 days after the date of publication in the Federal Register (it appears that they were published on August 4, making the purported effective date November 2). Done) or 18th December. But the Federal Register document says, “With respect to compliance with the event disclosure requirements in Item 1.05 of Form 8-K and Form 6-K [the part referring to the four-day requirement], All registrants other than smaller reporting companies will have to begin compliance from December 18, 2023. adding to the confusion, reuters It was reported in October that the rule would go into effect on December 15.
Engadget contacted the SEC to clarify whether the rule is still active. We will update this article if we get a response.
MeridianLink said bleepingcomputer It acted immediately to stop the threat. “Based on our investigation to date, we have found no evidence of unauthorized access to our production platforms and this incident has caused minimal business disruption,” the company wrote. The company says it is still trying to determine whether any consumers’ personal information was breached, and promises to notify affected parties if so.
Should the SEC have the ability (or willingness) to do anything about MeridianLink’s failure to report the incident within four business days, ironically this rule could serve as a new tool for cyber attackers . Instead of contacting customers or calling companies to tighten their grip and pressure them into meeting their demands, perhaps they can now simply tell them to Uncle Sam.
Source: www.engadget.com
