4 ms·

Ransomware Group Files SEC Complaint over Victim's Failure Disclose Data Breach

146 points by LinuxBender 3y ago

jerf 3y ago
What a magnificent snarl of incentives for the SEC. The SEC wants disclosure for good reasons, but if you disclose because the hacker group is the one that reported it, that is essentially the "negotiating with terrorists" incentive structure. Ignore the report because it's the hacking group and it opens the defense for all companies to claim the report is made by the hacking group (because they can easily be deceptive about who is reporting). And so on and so on... what a mess.
- AlotOfReading 3y ago
  "Pay up or we'll report you to the government" is a textbook example of blackmail. The gordian knot is easy to cut here though. The SEC can to refer illegal activities to the DOJ for prosecution separately from however they deal with the reporting issues.
  - jerf 3y ago
    Well, the SEC can refer all they want, but the DOJ is going to have jurisdiction over approximately 0% of the referrals.
    - RandomLensman 3y ago
      Want to refer it to the DOD instead?
      - brewdad 3y ago
        Interior? Education? We can keep referring until we hit the right department.
        nvy 3y ago
        The joke is that DOD is the long arm of US foreign policy. Can't prosecute? Invade.
      - jerf 3y ago
        Definitely closer to what I mean. Intelligence agencies is probably closer to the reality though. To those mystified by my crypticness, yes, my point is that the criminals are going to not be in the US and be where the US can't simply prosecute them, and this is not just a coincidence. They are in those places for that very reason. They may even be actively supported by their local government, so don't count on extradition or anything else like that. Even nominally friendly governments that we have treaties with are perfectly capable of 100% coincidentally simply not being able to find those guys, so sorry, we feel really bad for you though, if they want to. Paper is only worth the actions it produces.
      - bluGill 3y ago
        That depends. Most countries you refer to the department of state who in turn talks to law enforcement in the country where the hackers are from and that country takes care of the problem. However most hackers seem to be from countries like Russia, or North Korea where law enforcement will tell the state department to go away. DoD probably is the only option we have (though intelligence/CIA should get involved) - is it worth war?
    - JumpCrisscross 3y ago
      > the DOJ is going to have jurisdiction over approximately 0% of the referrals Why? A U.S.-listed company was hacked.
      - hiatus 3y ago
        I think they are referring to jurisdiction to enforce any judgement against the actor, which is likely in a foreign state with no extradition agreement with the US.
        JumpCrisscross 3y ago
        > jurisdiction to enforce any judgement against the actor, which is likely in a foreign state with no extradition agreement with the US Justice has a long memory. A common theme, when new extradition agreements are struck, usually in the context of trade or security arrangements, is how to deal with the backlog of overdue enforcement.
        hiatus 3y ago
        I agree in general, but I won't hold my breath for any agreement to be made between the US and Russia, Iran, North Korea, or China in my lifetime.
  - anonymousDan 3y ago
    Yes, I don't see the issue. If I understand correctly then reporting doesn't necessarily mean you are going to be in trouble (so long as you report in time)?
    - koolba 3y ago
      Plus you can use any SEC whistleblower money for your legal defense against the hacking.
  - autoexec 3y ago
    > "Pay up or we'll report you to the government" is a textbook example of blackmail. It's hard to feel too bad about companies who are actually doing illegal things that the government should be notified about anyway. It's like someone reporting their drug dealer to the police because they discovered their dealer was lacing their drugs with fentanyl. Sure, they're a snitch, but people are safer knowing the truth.
    - FireBeyond 3y ago
      Exactly. The desired outcomes may be different, but the incentives are temporarily, perversely aligned.
    - marcosdumay 3y ago
      Hum, no, your example is not blackmail. It would be like the customer asking for free drugs or else he would report the dealer. Anyway, the obvious course of action is to persecute the company and arrest the hacker. The problem here is probably that arresting the hacker is difficult.
- sonicanatidae 3y ago
  Oh I think they'll managed to figure out a way to keep corporations safe, at the expense of the citizens. That's the historical precedent.
  - JumpCrisscross 3y ago
    > at the expense of the citizens The SEC doesn't work for "the citizens," its mandate is in respect of investors. Especially small investors. U.S. law, broadly, prioritizes first consumers, then investors, and way, way, way below that, workers.
    - sonicanatidae 3y ago
      Citizens are investors and routinely take it in the shorts. The SEC's role is to manage the market, you know, with the fairness and all that.
- RationalDino 3y ago
  I don't see any snarl. The law requires disclosure so that companies can't hide material information from investors. The SEC wants all incentives lined up so that companies will choose to report. The primary way that the SEC catches them now is that the data showed up somewhere like a data breach. So ultimately, the behavior of the hacker group is the source. This hacker group just cut out several steps in the middle. The SEC verifies it, the company gets punished, and companies are on notice that they really should report. Just like the law says. What WOULD be a problem is if the hacker group got rewarded for reporting...
  - nickff 3y ago
    If the SEC pursues prosecutions based on reports from hackers which uses the threat of SEC reports to extract payments, the SEC will be enabling and enforcing blackmail. The SEC would essentially be an accessory to the crime.
    - elefanten 3y ago
      That’s not how the law would see it. Blackmailers incorporating otherwise-legal third party activity into their threat does not add legal liability for that 3rd party. Nor does it excuse any pre-existing liability for the blackmail target.
      - nickff 3y ago
        I'm not sure whether there'd be legal liability; that would probably depend on whether the third-party was aware of the scheme, and how often they 'enabled' it. I doubt that the SEC would be found to be an accessory the first time this happened (unless they'd been specifically warned), but if this happened frequently, I think they'd likely be found guilty by way of 'reckless or wanton negligence'. They might even be subjects of civil actions by victims of these blackmail schemes at a later date (if the circumstances were right).
  - fooker 3y ago
    >What WOULD be a problem is if the hacker group got rewarded for reporting Insider trading? But without being an actual insider.
- djyaz1200 3y ago
  Agree the incentives are a mess. SEC needs to change the incentives. For example, the process for filing complaints could include a $1M fee refundable at 2X if you're right and a tax-paying citizen and/or entity. These types of hackers exist outside of a society ruled by law, and it's unacceptable to let them leverage the tools of a civilized society if they don't live within its rules and pay taxes. If someone has a better idea for how to fix the incentives, I'd be sincerely interested to hear it.
dmoy 3y ago
> It’s worth pointing out that the new SEC data breach disclosure rules will only go into effect in mid-December 2023. In addition, companies will be required to notify the SEC within four business days of determining that a cybersecurity incident is material to investors, which, based on MeridianLink’s statement, has yet to happen. And there's the rub. Not so much the December bit, but the "material to investors" part. That has specific meaning, and until there are external requirements/penalties/whatever around security breaches, simple data theft may not rise to the level of materiality for the company. Since they e.g. don't really get hurt if their customers' private info is leaked. "We'll pay for three years of identity protection services if you sign up at XYZ link" is about all that happens today, if you're lucky. Well, multiply the cost of that (in bulk rates) by the number of customers who will actually bother signing up (pretty low %), and you get a number which is, to no surprise, probably not material for most companies. (Ransomware, e.g. physically stopping the business from functioning, probably does rise to the level of materiality, if no quick backup and recovery can be done)
- lainga 3y ago
  > Since they e.g. don't really get hurt if their customers' private info is leaked I don't know, that could depress future customer retention and hurt the business. Seems like it would run afoul of the Matt Levine Everything is Securities Fraud theory.
  - dmoy 3y ago
    > that could depress future customer retention and hurt the business. But it doesn't really though, does it? People largely dgaf. My info has been leaked by my hospital, medical insurance company, three major retailers, two social networks, etc etc. None of them appear to be impacted much, if at all. For some of them (insurance, the grocery store (!!?)), I don't have realistic choices to stop using the service anyways.
  - brewdad 3y ago
    Unless the event is especially egregious that seems unlikely. Firstly, most consumers won't even know the breach happened. Secondly, you can quickly run out of places to go. Lets say I leave Target because they get hit by a ransomware attack. A year later Walmart gets hit. Do I go back to Target? Shop exclusively online? Most likely, I continue to use whatever company or service is cheapest and most convenient. All of my PII is already on the Dark Web from a hundred other breaches by now.
bastard_op 3y ago
After having been part of various hacking cover-ups over the years, usually in some sort of triage for these sorts of things, I almost welcome the behavior vs. mega corporations or even state/local government getting away with it. Shame the fools that let it happen.
ceejayoz 3y ago
The really funny follow-up will be applying for a whistleblower award. https://www.sec.gov/whistleblower/claim-award https://www.sec.gov/whistleblower/claim-award (They won't get it; there's an exemption "If you obtained the information by a means or in a manner that is determined by a United States court to violate applicable Federal or state criminal law", but it'd be hilarious to try.)
- Chris2048 3y ago
  what if a third party disclosed the leak, and merely received a tipoff from the hackers. Would a tip-off count as illegal?
  - jtokoph 3y ago
    So you could have two hackers who each tip each other off to companies that they have independently hacked. They can just claim each other's rewards since they had nothing to do with the actual attack?
    - Chris2048 3y ago
      I guess. The old "Hackers on a train" dilemma.
  - gamblor956 3y ago
    It depends. If there is any evidence that the hackers colluded with the tipper so they could both share in the reward (i.e. if the hackers get any % of what the tipper gets), then the tip would be treated as part of the hack and the tipper would not be eligible for the reward.
  - qingcharles 3y ago
    It's called an inchoate crime: conspiracy.
fbdab103 3y ago
I guess everyone is looking for new revenue streams in this market.
tcbawo 3y ago
I wonder how many ransomware/hacking groups are being clandestinely paid by the sort of firms that would short the stock and benefit from such a disclosure. Or maybe these groups already plugged into the option markets and are profiting on both ends.
- raincom 3y ago
  Almost all middle-eastern governments hire ransomware/hacking groups to take on firms/companies they don't like. [1] [1] https://www.thebureauinvestigates.com/stories/2023-01-15/hacked-evidence-and-stolen-data-swamp-english-courts https://www.thebureauinvestigates.com/stories/2023-01-15/hac...
miga 3y ago
It is logical for the ransomware (or any lawbreaker) to minimize lawbreaker in order to reduce risk and penalty. It is also a legal act that may be considered to mitigate the guilt in the eyes of the court. Much safer than actually releasing the data. Why did other ransomware gangs did not think of this first? Is it because they are irrational or just lack proficiency in the law?

146 points by LinuxBender 3y ago

jerf 3y ago

What a magnificent snarl of incentives for the SEC. The SEC wants disclosure for good reasons, but if you disclose because the hacker group is the one that reported it, that is essentially the "negotiating with terrorists" incentive structure. Ignore the report because it's the hacking group and it opens the defense for all companies to claim the report is made by the hacking group (because they can easily be deceptive about who is reporting). And so on and so on... what a mess.

AlotOfReading 3y ago
"Pay up or we'll report you to the government" is a textbook example of blackmail. The gordian knot is easy to cut here though. The SEC can to refer illegal activities to the DOJ for prosecution separately from however they deal with the reporting issues.
- jerf 3y ago
  Well, the SEC can refer all they want, but the DOJ is going to have jurisdiction over approximately 0% of the referrals.
  - RandomLensman 3y ago
    Want to refer it to the DOD instead?
    - brewdad 3y ago
      Interior? Education? We can keep referring until we hit the right department.
      - nvy 3y ago
        The joke is that DOD is the long arm of US foreign policy. Can't prosecute? Invade.
    - jerf 3y ago
      Definitely closer to what I mean. Intelligence agencies is probably closer to the reality though. To those mystified by my crypticness, yes, my point is that the criminals are going to not be in the US and be where the US can't simply prosecute them, and this is not just a coincidence. They are in those places for that very reason. They may even be actively supported by their local government, so don't count on extradition or anything else like that. Even nominally friendly governments that we have treaties with are perfectly capable of 100% coincidentally simply not being able to find those guys, so sorry, we feel really bad for you though, if they want to. Paper is only worth the actions it produces.
    - bluGill 3y ago
      That depends. Most countries you refer to the department of state who in turn talks to law enforcement in the country where the hackers are from and that country takes care of the problem. However most hackers seem to be from countries like Russia, or North Korea where law enforcement will tell the state department to go away. DoD probably is the only option we have (though intelligence/CIA should get involved) - is it worth war?
  - JumpCrisscross 3y ago
    > the DOJ is going to have jurisdiction over approximately 0% of the referrals Why? A U.S.-listed company was hacked.
    - hiatus 3y ago
      I think they are referring to jurisdiction to enforce any judgement against the actor, which is likely in a foreign state with no extradition agreement with the US.
      - JumpCrisscross 3y ago
        > jurisdiction to enforce any judgement against the actor, which is likely in a foreign state with no extradition agreement with the US Justice has a long memory. A common theme, when new extradition agreements are struck, usually in the context of trade or security arrangements, is how to deal with the backlog of overdue enforcement.
        hiatus 3y ago
        I agree in general, but I won't hold my breath for any agreement to be made between the US and Russia, Iran, North Korea, or China in my lifetime.
- anonymousDan 3y ago
  Yes, I don't see the issue. If I understand correctly then reporting doesn't necessarily mean you are going to be in trouble (so long as you report in time)?
  - koolba 3y ago
    Plus you can use any SEC whistleblower money for your legal defense against the hacking.
- autoexec 3y ago
  > "Pay up or we'll report you to the government" is a textbook example of blackmail. It's hard to feel too bad about companies who are actually doing illegal things that the government should be notified about anyway. It's like someone reporting their drug dealer to the police because they discovered their dealer was lacing their drugs with fentanyl. Sure, they're a snitch, but people are safer knowing the truth.
  - FireBeyond 3y ago
    Exactly. The desired outcomes may be different, but the incentives are temporarily, perversely aligned.
  - marcosdumay 3y ago
    Hum, no, your example is not blackmail. It would be like the customer asking for free drugs or else he would report the dealer. Anyway, the obvious course of action is to persecute the company and arrest the hacker. The problem here is probably that arresting the hacker is difficult.
sonicanatidae 3y ago
Oh I think they'll managed to figure out a way to keep corporations safe, at the expense of the citizens. That's the historical precedent.
- JumpCrisscross 3y ago
  > at the expense of the citizens The SEC doesn't work for "the citizens," its mandate is in respect of investors. Especially small investors. U.S. law, broadly, prioritizes first consumers, then investors, and way, way, way below that, workers.
  - sonicanatidae 3y ago
    Citizens are investors and routinely take it in the shorts. The SEC's role is to manage the market, you know, with the fairness and all that.
RationalDino 3y ago
I don't see any snarl. The law requires disclosure so that companies can't hide material information from investors. The SEC wants all incentives lined up so that companies will choose to report. The primary way that the SEC catches them now is that the data showed up somewhere like a data breach. So ultimately, the behavior of the hacker group is the source. This hacker group just cut out several steps in the middle. The SEC verifies it, the company gets punished, and companies are on notice that they really should report. Just like the law says. What WOULD be a problem is if the hacker group got rewarded for reporting...
- nickff 3y ago
  If the SEC pursues prosecutions based on reports from hackers which uses the threat of SEC reports to extract payments, the SEC will be enabling and enforcing blackmail. The SEC would essentially be an accessory to the crime.
  - elefanten 3y ago
    That’s not how the law would see it. Blackmailers incorporating otherwise-legal third party activity into their threat does not add legal liability for that 3rd party. Nor does it excuse any pre-existing liability for the blackmail target.
    - nickff 3y ago
      I'm not sure whether there'd be legal liability; that would probably depend on whether the third-party was aware of the scheme, and how often they 'enabled' it. I doubt that the SEC would be found to be an accessory the first time this happened (unless they'd been specifically warned), but if this happened frequently, I think they'd likely be found guilty by way of 'reckless or wanton negligence'. They might even be subjects of civil actions by victims of these blackmail schemes at a later date (if the circumstances were right).
- fooker 3y ago
  >What WOULD be a problem is if the hacker group got rewarded for reporting Insider trading? But without being an actual insider.
djyaz1200 3y ago
Agree the incentives are a mess. SEC needs to change the incentives. For example, the process for filing complaints could include a $1M fee refundable at 2X if you're right and a tax-paying citizen and/or entity. These types of hackers exist outside of a society ruled by law, and it's unacceptable to let them leverage the tools of a civilized society if they don't live within its rules and pay taxes. If someone has a better idea for how to fix the incentives, I'd be sincerely interested to hear it.

dmoy 3y ago

> It’s worth pointing out that the new SEC data breach disclosure rules will only go into effect in mid-December 2023. In addition, companies will be required to notify the SEC within four business days of determining that a cybersecurity incident is material to investors, which, based on MeridianLink’s statement, has yet to happen. And there's the rub. Not so much the December bit, but the "material to investors" part. That has specific meaning, and until there are external requirements/penalties/whatever around security breaches, simple data theft may not rise to the level of materiality for the company. Since they e.g. don't really get hurt if their customers' private info is leaked. "We'll pay for three years of identity protection services if you sign up at XYZ link" is about all that happens today, if you're lucky. Well, multiply the cost of that (in bulk rates) by the number of customers who will actually bother signing up (pretty low %), and you get a number which is, to no surprise, probably not material for most companies. (Ransomware, e.g. physically stopping the business from functioning, probably does rise to the level of materiality, if no quick backup and recovery can be done)

lainga 3y ago
> Since they e.g. don't really get hurt if their customers' private info is leaked I don't know, that could depress future customer retention and hurt the business. Seems like it would run afoul of the Matt Levine Everything is Securities Fraud theory.
- dmoy 3y ago
  > that could depress future customer retention and hurt the business. But it doesn't really though, does it? People largely dgaf. My info has been leaked by my hospital, medical insurance company, three major retailers, two social networks, etc etc. None of them appear to be impacted much, if at all. For some of them (insurance, the grocery store (!!?)), I don't have realistic choices to stop using the service anyways.
- brewdad 3y ago
  Unless the event is especially egregious that seems unlikely. Firstly, most consumers won't even know the breach happened. Secondly, you can quickly run out of places to go. Lets say I leave Target because they get hit by a ransomware attack. A year later Walmart gets hit. Do I go back to Target? Shop exclusively online? Most likely, I continue to use whatever company or service is cheapest and most convenient. All of my PII is already on the Dark Web from a hundred other breaches by now.

bastard_op 3y ago

After having been part of various hacking cover-ups over the years, usually in some sort of triage for these sorts of things, I almost welcome the behavior vs. mega corporations or even state/local government getting away with it. Shame the fools that let it happen.

ceejayoz 3y ago

The really funny follow-up will be applying for a whistleblower award. https://www.sec.gov/whistleblower/claim-award https://www.sec.gov/whistleblower/claim-award (They won't get it; there's an exemption "If you obtained the information by a means or in a manner that is determined by a United States court to violate applicable Federal or state criminal law", but it'd be hilarious to try.)

Chris2048 3y ago
what if a third party disclosed the leak, and merely received a tipoff from the hackers. Would a tip-off count as illegal?
- jtokoph 3y ago
  So you could have two hackers who each tip each other off to companies that they have independently hacked. They can just claim each other's rewards since they had nothing to do with the actual attack?
  - Chris2048 3y ago
    I guess. The old "Hackers on a train" dilemma.
- gamblor956 3y ago
  It depends. If there is any evidence that the hackers colluded with the tipper so they could both share in the reward (i.e. if the hackers get any % of what the tipper gets), then the tip would be treated as part of the hack and the tipper would not be eligible for the reward.
- qingcharles 3y ago
  It's called an inchoate crime: conspiracy.

fbdab103 3y ago

I guess everyone is looking for new revenue streams in this market.

tcbawo 3y ago

I wonder how many ransomware/hacking groups are being clandestinely paid by the sort of firms that would short the stock and benefit from such a disclosure. Or maybe these groups already plugged into the option markets and are profiting on both ends.

raincom 3y ago
Almost all middle-eastern governments hire ransomware/hacking groups to take on firms/companies they don't like. [1] [1] https://www.thebureauinvestigates.com/stories/2023-01-15/hacked-evidence-and-stolen-data-swamp-english-courts https://www.thebureauinvestigates.com/stories/2023-01-15/hac...

miga 3y ago

It is logical for the ransomware (or any lawbreaker) to minimize lawbreaker in order to reduce risk and penalty. It is also a legal act that may be considered to mitigate the guilt in the eyes of the court. Much safer than actually releasing the data. Why did other ransomware gangs did not think of this first? Is it because they are irrational or just lack proficiency in the law?