“The ALPHV/BlackCat ransomware operation has taken extortion to a new level”
ALPHV broke into MeridianLink on November 7, stole data, then reported its own victim to the SEC for not disclosing it. The rule they cite requires disclosure four business days after a company decides a breach is material. It does not take effect until December 15, 2023. Criminals now read securities regulations more closely than the companies they rob.