|
Hello. I’ve been following the back and forth between AlphV and fintech firm MeridianLink, where the hacking group apparently filed a complaint with the Securities and Exchange Commission saying the company failed to notify the regulator of a cyberattack.
Under new SEC rules, a company must disclose a cyber incident within four days of deeming it material. The materiality designation starts the clock. (See our explainer, here.)
Keep in mind the rules don’t go into effect until mid-December. More importantly, the hackers can't tell if their attack will be material for MeridianLink. The company said Monday it found unauthorized access to one user’s account and shut down the intruder.
“Our forensic investigation confirms that the threat actor did not access MeridianLink’s networks, servers, databases, integrations, or any part of our customer product platforms,” the company said in a statement. No malware, including ransomware, was deployed.
I asked a MeridianLink spokeswoman whether the incident is or will be deemed material. She said the investigation is continuing and notifications, should they be required, will be done.
Don’t get me wrong: A stunt like AlphV’s jacks up pressure on hacked companies. But it’s no cause for panic.
More news:
-
Third time's a charm for North Korea's spy satellite
-
Binance to pay $4.3 billion and founder steps down
-
Boeing shares details of Citrix Bleed attack
-
Virtual credit cards can guard against security threats
Please note: The WSJ Pro Cybersecurity newsletter will take a break for Thanksgiving and will be back in inboxes on Monday.
|
