The ALPHV ransomware group has filed a complaint with the US Securities and Exchange Commission (SEC) amid claims that a victim organization failed to disclose a security breach.
ALPHV claims that MeridianLink, a digital solutions provider for financial services institutions, did not comply with SEC regulations stating an organization must disclose a cyber attack within four working days.
The ransomware group added MeridianLink to its victim list leak site this week after an alleged successful attack against the company on 7 November, giving the firm 24 hours to comply with a ransom demand.
ALPHV said that no files were encrypted in the attack, but it did exfiltrate company data.
A copy of the SEC filing shared with DataBreaches suggests MeridianLink failed to adhere to disclosure rules in the wake of the breach, which require a company to disclose an incident through a Form 8-K with the regulator.
The new four-day disclosure rule was announced by the SEC in July 2023 in a bid to improve data breach reporting for US organizations. The new guidelines aren’t set to come into force until December, however.
“We want to bring to your attention a concerning issue regarding MeridianLink’s compliance with the recently adopted cybersecurity incident disclosure rules,” the ALPHV complaint reads.
“It has come to our attention that MeridianLink, in light of a significant breach compromising customer data and operational information, has failed to file the requisite disclosure under Item 1.05 of Form 8-K within the stipulated four business days, as mandated by the new SEC rules.”
ALPHV told DataBreaches that an individual from MeridianLink had reached out to the group in the wake of the breach, but talks went cold. The group further alleges that the solutions provider “patched the way used to get in” after the group’s threat was issued.
In response to the filing, MeridianLink told the publication it “acted immediately to contain the threat” and has since engaged with third-party security experts to investigate the incident.
“We have identified no evidence of unauthorized access to our production platforms, and the incident has caused minimal business interruption.”
