In a groundbreaking development in the realm of ransomware, ALPHV, also known as BlackCAT, has taken an unprecedented step by filing a complaint with the Security and Exchange Commission (SEC) against a victim who failed to adhere to the stipulated rule mandating disclosure of a cyber attack within a 4-day timeframe.
The targeted victim in this case is Meridian Link, a trading company specializing in providing tech solutions to financial institutions and banks. BlackCAT’s recent action indicates an alarming escalation in the tactics employed by cybercriminals, as they venture into publicly shaming their victims. Previously, ransomware groups typically resorted to tactics such as encrypting a victim’s database until a ransom was paid. Subsequently, they elevated their extortion methods by stealing sensitive data and issuing threats to release or sell it, applying pressure on the victim. A further tactic involved threatening to damage the victim’s reputation among competitors, partners, or customers. Now, these criminal entities seem to have reached a new low by formally filing a complaint with the SEC against their victim.
The SEC, however, systematically reviews such complaints, scrutinizing the technical aspects while assessing the credibility of the entity filing the complaint. And in this case, the SEC will collaborate with law enforcement agencies to appropriately address the situation.
ALPHV underscored its audacious move by publishing a screenshot of the complaint form submitted on the SEC website in a public Telegram channel.
In response, MeridianLink has acknowledged the authenticity of the data breach news and has expressed its intention to seek assistance from law enforcement in addressing the matter. Nevertheless, the company has yet to disclose specific details about the breach, including the timing of the cyber attack, when it was identified, and the extent of data loss.
