How Hackers Make Their Victims Criminals

BlackCat, AlphaV, AI generated

MeridianLink, a financial company, was the victim of a unique approach of cyberattack on 7th November.

The initial attack was typical; hacker group BlackCat (also known as ALPHV) breached their systems, leading to data being stolen. However, what differentiates this attack is what followed. Upon receiving no engagement  from their victim when attempting to communicate, assumably regarding a ransom demand, BlackCat took a unique step.

They took the liberty of reporting their own victim to the Securities and Exchange Commission (SEC) on the grounds of failing to disclose the attack. This is a consequence of a recent change of regulations in which companies are now required to disclose cyber incidents within 4 days of their occurrence.

Fortunately for MeridianLink, the rule change does not come into place until 15th December. Had this event occurred after that date, and they had not disclosed the attack, BlackCat may have succeeded in making a criminal out of their hacking victim.


Does the SEC Rule Apply in the UK?

No, but a similar policy does apply.

In the UK the Information Commissioner’s Office has a similar policy, requiring companies to report cyber incidents after 72 hours. This applies as long as there has been a data breach, and you cannot prove that it is unlikely to result in a risk to individuals’ rights and freedoms.


Does a Disclosure Deadline Put Companies at Higher Risk?

Putting in place a disclosure deadline may create opportunities for other threat actors to take advantage of the vulnerability before it is remediated. When an organisation is rushed to disclose that they were attacked, they may not have time to be thorough in their remediation and could leave gaps in their security. This is especially relevant as their systems will likely be under increased scrutiny from hackers after the announcement of a breach, putting them in the limelight.

This may propose a higher risk to unprepared organisations who find themselves victim to cyberattacks and do not know where the vulnerability is located. The rule changes encourage preparedness, leading to the next point of this article.


How Do I Protect Myself From this Risk?

This rule change increases pressure on companies in the event of a cyberattack, by increasing the relevance of time as a factor in remediation. Taking this into consideration, the key takeaway for businesses is the importance of proactivity.

Instead of playing catch-up by waiting to be attacked and then remediating, take proactive measures to reduce the chance of attacks occurring in the first place and to plan what will happen should an attack occur.

  • Ensure you have 24/7 visibility of weaknesses.
  • Remediate vulnerabilities as they arise.
  • Create backups of all systems in case a cyberattack does occur.
  • Create an incident response plan for cyberattacks.
Share this post:

Other posts you may be interested in

Book a free consultation with a Cyber Safe expert

Our experts can discuss penetration testing, web or mobile application pen testing, continuous protection, and all levels of certification.

Contact our cyber team to discuss any and all of your cyber needs.
Fill in the form below and one of the Cyber Safe experts will be in touch.
  • Newcastle office: 0191 249 3003
  • London office: 0203 793 9679