iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
ALPHV/BlackCat claimed in November 2023 that it had breached MeridianLink and filed a complaint with the U.S. Securities and Exchange Commission alleging the company failed to disclose the incident. The complaint was part of the group’s extortion pressure—not an SEC finding. MeridianLink disputed the group’s timeline, and the SEC’s new incident-disclosure deadline had not yet taken effect when the complaint was reported.
What ALPHV/BlackCat claimed about MeridianLink
On November 16, 2023, SecurityWeek reported that the ALPHV/BlackCat ransomware group claimed it had breached MeridianLink, a provider of digital lending and data-verification solutions. The group said it had stolen customer and operational data and threatened to publish it unless MeridianLink paid a ransom. SecurityWeek reported that the group described the incident as data theft without file encryption; that characterization was the group’s account, not a verified forensic finding. SecurityWeek’s report said the group posted screenshots it described as showing an SEC complaint and a receipt.
The group also alleged that MeridianLink had failed to report the incident as required by the SEC’s newly adopted cybersecurity disclosure rules. ThreatDown reproduced wording attributed to the complaint: “We want to bring to your attention a concerning issue regarding MeridianLink’s compliance with the recently adopted cybersecurity incident disclosure rules.” That is wording attributed to the threat actor by a secondary source, not an independently authenticated SEC document. ThreatDown’s account likewise describes the submission as the group’s action.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11A complaint’s submission does not prove the allegations, establish that the SEC accepted them as true, or show that the agency reached a conclusion. The incident reports cited here do not establish a later SEC finding about the complaint or a final forensic account of the intrusion.
#1 Best Overall
MeridianLink and the group gave different attack dates
The accounts reported at the time did not agree on when the intrusion occurred. SecurityWeek reported that ALPHV/BlackCat told DataBreaches.net the attack happened on November 7, 2023, and was discovered that day. MeridianLink told DataBreaches.net the intrusion occurred on November 10. The exact date is not resolved by those reports. SecurityWeek
MeridianLink said that it acted to contain the threat upon discovery and brought in third-party experts. It said: “Upon discovery on the same day, we acted immediately to contain the threat and engaged a team of third-party experts to investigate the incident. Based on our investigation to date, we have identified no evidence of unauthorized access to our production platforms, and the incident has caused minimal business interruption,” The company also said it could not provide further details while the investigation was ongoing. This was MeridianLink’s contemporaneous statement, not a final account of the incident.
What the SEC’s four-business-day rule required
The SEC adopted its cybersecurity disclosure rules on July 26, 2023. Under the rule, a registrant generally must file a Form 8-K under Item 1.05 within four business days after it determines that a cybersecurity incident is material. The clock does not automatically start on the day of the attack or its discovery. The SEC’s July 26 announcement explains the rule and its limited national-security and public-safety delay process.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →That timing distinction matters: discovery and a materiality determination are separate events. The four-business-day deadline runs from the company’s determination that the incident is material, not simply from learning that an intrusion may have occurred. The SEC said disclosure may be delayed if the U.S. Attorney General determines that immediate disclosure would pose a substantial risk to national security or public safety and notifies the Commission in writing.
Rank #3
Materiality is also a threshold. In a May 2024 staff statement, the SEC explained that Item 1.05 is for incidents the registrant determines are material. If an incident has not yet been determined material, or is determined not to be material, a company may disclose it under another item, such as Item 8.01. If the company later determines the incident is material, it should file under Item 1.05 within four business days of that determination. The SEC staff statement discusses that distinction. The rule does not automatically require an Item 1.05 filing for every cyber incident.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Why the November 2023 complaint’s timing matters
The SEC’s standard incident-disclosure compliance date was the later of 90 days after publication in the Federal Register or December 18, 2023. Smaller reporting companies received an additional transition period. Since the complaint was reported in November 2023, the standard compliance date had not arrived. On the reported timeline, the group’s assertion that MeridianLink had already violated the new deadline was premature. That is a reading of the SEC’s stated compliance dates alongside the reported dates—not an SEC finding about MeridianLink. The dates and transition period appear in the SEC’s rule announcement.
Quick Recap
Best Value
What the incident does—and does not—show
- ALPHV/BlackCat claimed a breach and data theft, threatened publication unless it received a ransom, and said it filed an SEC complaint. Those are the group’s claims, not independently established facts.
- MeridianLink said it contained the threat, engaged outside experts, and had found no evidence of unauthorized access to its production platforms based on its investigation at that time.
- The reported accounts conflict on the intrusion date, and the available reporting does not establish the full scope of any data access.
- The SEC rule’s general four-business-day period begins after a registrant determines an incident is material; it is not a four-day countdown from attack or discovery.
- The available incident reporting does not establish a final SEC assessment of the complaint.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
