In an unusual twist on cybercrime, the Black Cat/ALPHV ransomware group has filed a complaint with the U.S. Securities and Exchange Commission (SEC) alleging that one of their victims did not disclose a cyberattack to the SEC in the mandated four-day window, according to a report by Bleeping Computer. The ransomware group, it seems, is attempting to use the SEC’s recently enacted public cyber disclosure rule as another tool to pressure its victim.
This action by a criminal group underscores the evolving nature and growing sophistication of cyber threats. Firms not only have to contend with the immediate damage caused by a cyberattack but also the regulatory repercussions for failing to promptly report such incidents.
The SEC’s new rule requires that companies report material cybersecurity incidents to the commission within four days of determining that an event has taken place. This rule intends to increase transparency about the scale and scope of cyber threats facing companies, but this case illustrates that it may be a double-edged sword, giving cybercriminals a new mechanism to exert pressure on their victims.
The potential implications of this new approach to cyber extortion are vast for companies and legal professionals navigating these challenges. Legal teams must balance the need to adequately and swiftly communicate with regulatory bodies, acknowledging and accounting for the possibility that attackers might also be aware of these obligations.
As we enter into a new era of increasingly aggressive ransomware attacks, where perpetrators are not just content with seizing a company’s digital assets but are also employing regulatory tactics, it is clear that companies and their legal teams need to be well-equipped to manage multifaceted crises arising from cybersecurity incidents.
Keeping abreast of the evolving tactics utilized by ransomware groups, understanding cybersecurity regulatory requirements, and developing robust crisis communications strategies will be key in this new cyber landscape.