In November 2023, the ransomware group ALPHV/BlackCat claimed it had breached MeridianLink and filed a complaint with the Securities and Exchange Commission accusing the company of failing to disclose the incident. That was the group’s allegation—not an SEC finding. MeridianLink gave a different account of the incident’s timing and said it had found no evidence of unauthorized access to its production platforms as of its investigation at that time.
What ALPHV/BlackCat claimed
On November 16, 2023, SecurityWeek reported that ALPHV/BlackCat claimed to have breached MeridianLink, a provider of digital lending and data verification solutions. The group said it had stolen customer and operational data, threatened to publish it unless a ransom was paid, and filed an SEC complaint alleging that MeridianLink had failed to disclose the incident. SecurityWeek said the group posted screenshots it described as showing the complaint and a receipt. These claims were attributed to the group and were not independently established by the report. SecurityWeek’s report
As an Amazon Associate I earn from qualifying purchases.
SecurityWeek also reported that the group characterized the incident as data theft without file encryption. That description, like its claims about the breach and data, was the group’s account rather than a verified forensic conclusion.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What MeridianLink said—and what remains uncertain
The accounts differed on when the intrusion occurred. SecurityWeek reported that ALPHV/BlackCat told DataBreaches.net the attack happened on November 7, 2023, and was discovered that day. MeridianLink told DataBreaches.net the intrusion occurred on November 10. The available reporting does not resolve the exact date or establish the full scope of any data access. SecurityWeek’s report
#1 Best Overall
MeridianLink said: “Upon discovery on the same day, we acted immediately to contain the threat and engaged a team of third-party experts to investigate the incident. Based on our investigation to date, we have identified no evidence of unauthorized access to our production platforms, and the incident has caused minimal business interruption,” The company said it could not share further details during the investigation. This was the company’s contemporaneous statement, not a final forensic account.
What the SEC’s four-business-day rule actually requires
The SEC adopted its cybersecurity disclosure rules on July 26, 2023. For a registrant that determines a cybersecurity incident is material, the general requirement is to file a Form 8-K under Item 1.05 within four business days of making that materiality determination. The clock does not automatically start four days after the attack or its discovery. The SEC allows a delay if the U.S. Attorney General determines that immediate disclosure would pose a substantial risk to national security or public safety and notifies the Commission in writing. SEC announcement of the rules
| Clock or disclosure | What it means |
|---|---|
| Incident discovered | Discovery alone does not start the four-business-day Item 1.05 deadline. |
| Company determines incident is material | The general four-business-day period for an Item 1.05 Form 8-K begins. |
| Incident not yet determined material, or determined not material | The SEC staff says a company may disclose under another item, such as Item 8.01. If it later determines the incident is material, it should file under Item 1.05 within four business days of that determination. |
The SEC staff explained the distinction in a May 2024 statement. Item 1.05 is for incidents the registrant has determined to be material; the rule does not automatically require an Item 1.05 disclosure for every cyber incident. SEC staff statement on Item 1.05
Recommended Free Tools
SEC Chair Gary Gensler summarized the investor-focused materiality principle in the July 2023 announcement: “Whether a company loses a factory in a fire — or millions of files in a cybersecurity incident — it may be material to investors.” He was describing how an incident can matter to investors, not commenting on MeridianLink specifically. SEC announcement of the rules
Rank #3
Why the complaint’s timing matters
The SEC set the standard incident-disclosure compliance date as the later of 90 days after publication in the Federal Register or December 18, 2023; smaller reporting companies received an additional transition period. The complaint was reported in November 2023, before the standard compliance date. On the dates reported, the group’s assertion that MeridianLink had already violated the new disclosure deadline was therefore premature. That is a reading of the SEC’s stated dates and contemporaneous reporting, not an SEC determination about MeridianLink. SEC announcement of the rules SecurityWeek’s report
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Can a ransomware gang file an SEC complaint against a company?
ALPHV/BlackCat claimed to have submitted a complaint in this case. A complaint submission, however, does not establish that its allegations are true, that the SEC endorsed them, or that the regulator made a finding. Threat actors can use a regulator-facing allegation as part of an extortion effort, but the available reporting records no later SEC conclusion about this complaint and does not resolve the incident’s final forensic facts.
ThreatDown reproduced wording it attributed to the complaint: “We want to bring to your attention a concerning issue regarding MeridianLink’s compliance with the recently adopted cybersecurity incident disclosure rules.” Because that wording is reproduced by a secondary source and the complaint’s allegations are not an SEC finding, it should be read as alleged complaint language, not as an authenticated SEC statement. ThreatDown’s account
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesQuick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
