Week of December 18, 2023: SEC incident rule takes effect with VF's 8-K, and the FBI disrupts ALPHV/BlackCat

What mattered to security leaders in the week of December 18, 2023? The SEC's new Form 8-K requirement for material cybersecurity incidents became due on December 18, and V.F. Corporation and First American Financial filed under the new Item 1.05 within days. The US Justice Department also announced a disruption of the ALPHV/BlackCat ransomware operation, including an FBI decryptor offered to more than 500 victims, and Comcast confirmed that Citrix Bleed exposed data on over 35.8 million Xfinity customers.

The SEC's incident disclosure requirement begins, and VF Corp files on day one

Under rules adopted in July, the SEC set December 18, 2023 as the earliest date the new Form 8-K incident disclosures would be due, with smaller reporting companies given 180 more days. V.F. Corporation, which sells its brands through retail stores and e-commerce, filed an Item 1.05 report that day: it detected unauthorized activity on December 13, and the attacker encrypted some IT systems and stole data, including personal data. VF said order fulfillment was impaired and the incident was reasonably likely to keep materially affecting operations until recovery. (US Securities and Exchange Commission, V.F. Corporation, SEC Form 8-K)

First American isolates systems and reports under Item 1.05

Title insurer First American Financial Corporation filed its own Item 1.05 report on December 22. It said it had identified unauthorized activity on certain IT systems and, on December 20, chose to isolate systems from the internet, which could leave its main website unavailable. The company said it could not yet estimate how long the disruption would last or whether the incident would materially affect its financial condition. Together with VF's report, it gave investors early examples of what an Item 1.05 disclosure looks like. (First American Financial Corporation, SEC Form 8-K)

Justice Department announces ALPHV/BlackCat disruption and an FBI decryptor

On December 19 the Justice Department announced a campaign against ALPHV/BlackCat, which it described as the second most prolific ransomware-as-a-service operation of the prior 18 months. The FBI built a decryption tool that its field offices and foreign partners offered to more than 500 victims, sparing multiple victims ransom demands totaling approximately $68 million, and seized several of the group's websites. Organizations hit by BlackCat had a reason to contact the FBI before negotiating. (Help Net Security)

FBI, CISA and Australia's ACSC detail Play ransomware

A joint #StopRansomware advisory published on December 18 by the FBI, CISA and the Australian Signals Directorate's ACSC set out Play ransomware's tactics and indicators, drawn from FBI investigations through October 2023. Play steals data before encrypting systems and has hit businesses and critical infrastructure across North America, South America, Europe and Australia. The indicators give detection teams something concrete to load into their tooling. (CISA)

Comcast confirms Citrix Bleed breach affecting 35.8 million Xfinity customers

Comcast confirmed that attackers exploiting CVE-2023-4966, the Citrix NetScaler flaw known as Citrix Bleed, accessed internal Xfinity systems between October 16 and October 19, before the company finished mitigation. It determined on November 16 that information was likely taken. The data covered more than 35.8 million customers and included usernames and hashed passwords, and for some, names, contact details and the last four digits of Social Security numbers. (Help Net Security)

Mr. Cooper puts its October breach at more than 14.6 million customers

Mortgage servicer Mr. Cooper told customers that personal information for more than 14.6 million people was taken in the breach it detected on October 31. Its notice said an unauthorized party accessed certain systems between October 30 and November 1, 2023 and obtained files containing names, addresses, phone numbers, Social Security numbers, dates of birth and bank account numbers. People whose loans had been serviced by Nationstar Mortgage, Centex Home Equity or sister brands could also be affected. (Help Net Security)