Total Tests:
Stay in Touch

Get exclusive updates and invitations to our events and webinars:


Your data will stay confidential Private and Confidential

Ransomware Group Trolls Victim With SEC Complaint After Data Breach

By Scott Ikeda for CPO Magazine
Tuesday, November 21, 2023

It might be a new pressure tactic, or it might be old-fashioned trolling. Whatever the case, a ransomware gang has filed an SEC complaint directed at one of its victims. The complaint notes that the data breach took place over a week prior, and claims that new SEC rules require the victim to disclose a material impact within four business days.

Nature of the information stolen in MeridianLink data breach still unclear

The hackers used the automated “Tips, Complaints, and Referrals” page to submit the SEC complaint, so the verification that was posted of receipt of the complaint does not indicate that anything will be done with it. MeridianLink may have legitimate reporting requirements coming up soon, however, if the company determines there is a potential material impact to shareholders from the data breach.

As Dr. Ilia Kolochenko, Chief Architect at ImmuniWeb, notes: ” … Not all security incidents are data breaches, and not all data breaches are reportable data breaches. Therefore, regulatory agencies and authorities should carefully scrutinize such reports and probably even establish a new rule to ignore reports uncorroborated with trustworthy evidence, otherwise, exaggerated or even completely false complaints will flood their systems with noise and paralyze their work. Victims of data breaches should urgently consider revising their digital forensics and incident response (DFIR) strategies by inviting corporate jurists and external law firms specialized in cybersecurity to participate in the creation, testing, management and continuous improvement of their DFIR plan. Many large organizations still have only technical people managing the entire process, eventually triggering such undesirable events as criminal prosecution of CISOs and a broad spectrum of legal ramifications for the entire organization. Transparent, well-thought-out and timely response to a data breach can save millions.”

It would help the situation greatly for MeridianLink to determine whether or not customer personal or financial information was taken in the data breach. The company’s primary product line is a set of loan origination tools for banks and other lenders, something that could obviously contain highly damaging information. Read Full Article


Book a Call Ask a Question
Close
Talk to ImmuniWeb Experts
ImmuniWeb AI Platform
Have a Technical Question?

Our security experts will answer within
one business day. No obligations.

Have a Sales Question?
Email:
Tel: +41 22 560 6800 (Switzerland)
Tel: +1 720 605 9147 (USA)
*
*
*
*
Your data will stay private and confidential