In November 2023, the ALPHV/BlackCat ransomware operation said it had submitted a complaint to the U.S. Securities and Exchange Commission (SEC) accusing MeridianLink of failing to disclose a breach. The claim was part of the attackers’ pressure campaign—not an SEC finding—and the SEC’s new four-business-day cyber-disclosure requirement was not yet in effect when the story broke.
What happened between ALPHV/BlackCat and MeridianLink?
ALPHV/BlackCat claimed MeridianLink was a victim and posted a screenshot of a submission it said it had made through the SEC’s complaint portal. Contemporary reporting said the gang threatened to publish allegedly stolen data unless MeridianLink paid. Those claims about data theft and the attackers’ account of events were not independently established in the cited reports. Ars Technica reported on the allegation.
As an Amazon Associate I earn from qualifying purchases.
MeridianLink confirmed it had identified a cybersecurity incident, said it acted to contain the threat, and engaged third-party experts to investigate. At the time of its statement, the company said it had found no evidence of unauthorized access to its production platforms and that business interruption was minimal. It was still investigating whether consumer personal information was involved. Ars Technica published the company’s statement.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The distinction matters: an attacker’s complaint is not proof of the attacker’s allegations, and a complaint submitted to the SEC is not a regulator’s conclusion. The cited reporting described an acknowledgment of receipt, not a substantive SEC determination or enforcement action.
#1 Best Overall
Does the SEC require a company to report a hack within four days?
Not four days from the attack or its discovery. Under Item 1.05 of Form 8-K, a public company generally must report a cybersecurity incident within four business days after determining that the incident is material. The company must make that materiality determination without unreasonable delay after discovering the incident. SEC staff guidance explains how the timing works.
The SEC adopted the cybersecurity disclosure rules on July 26, 2023. They require disclosure of material aspects of the incident’s nature, scope, and timing, as well as its material or reasonably likely material impact. SEC Chair Gary Gensler said at adoption: “Whether a company loses a factory in a fire — or millions of files in a cybersecurity incident — it may be material to investors.” The SEC’s staff statement discusses the rule’s purpose.
- Discovery: The company learns of a potential incident and investigates.
- Materiality decision: The company assesses the incident’s significance to investors and must not unreasonably delay that assessment.
- Filing deadline: If the company determines the incident is material, the four-business-day period begins on that determination.
Was the new rule already in force when the complaint was reported?
No. The SEC’s incident-disclosure requirements began on December 18, 2023, or the later applicable date under the rule. The ALPHV/BlackCat complaint story broke in mid-November 2023, before that start date. The attacker’s allegation therefore should not be treated as proof that MeridianLink violated the new Item 1.05 requirement. The SEC describes the rule and its effective dates.
Free tools Windows power users keep installed
One-click scans. No signup required.
Can a company disclose an incident before deciding it is material?
Yes. In a May 2024 staff statement, the SEC’s Division of Corporation Finance Director Erik Gerding clarified that Item 1.05 is intended for incidents a registrant determines to be material. A company may disclose an incident before reaching that decision under another Form 8-K item, such as Item 8.01. If it later determines the incident is material, the staff said it should file under Item 1.05 within four business days of that determination. This was staff clarification of the rule, not a new rule. Read the May 2024 staff statement.
Rank #3
What can a company leave out of an Item 1.05 filing?
The filing must cover material aspects of the incident and its impact, but the rule does not require technical detail so extensive that it would impede response or remediation. If information is unavailable when the company files, it may say so and file an amendment as required. The Attorney General may authorize delayed disclosure when immediate reporting would pose a substantial risk to national security or public safety. The SEC staff statement summarizes these requirements and exceptions.
Quick Recap
Best Value
What is established—and what is not?
- ALPHV/BlackCat said it submitted a complaint about MeridianLink; that was the gang’s claim, not an SEC finding.
- MeridianLink confirmed a cybersecurity incident and reported no evidence of unauthorized access to production platforms and minimal business interruption at the time of its statement.
- The cited accounts do not establish the full scope of any data theft or show that the SEC reached a substantive conclusion about the complaint.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
