Russian-linked cybercriminals claim to have published troves of sensitive data after a large law firm used by the Australian government vowed not to bend to their ransom demands.
Late last night the AlphV ransomware gang, also known as BlackCat, said it had published 1.45 terabytes of data on the dark web that it allegedly stole from HWL Ebsworth in late April, with the message: “ENJOY!!!”
It is unclear what data was published but AlphV has previously claimed to be in possession of internal company data including financial and insurance data, credit card information, agreements and reports.
If the group’s claims are accurate, it means hackers are still holding onto 2.55 terabytes of unpublished data.
AlphV’s claim was first picked up by threat analyst @CyberKnow20 on Twitter.
A spokesman for HWL Ebsworth said the firm was investigating the claim.
“We have learnt that the cyber criminals who accessed our systems have now claimed to have published around one-third of the total data they say has been exfiltrated from our firm,” he said.
“We are investigating this claim and are seeking to identify what data may have been published.
“HWL Ebsworth will not submit to the ransom demand.
“We take our ethical and moral duties to the community very seriously, and we consider we have a fundamental civic duty to not, in any way, encourage or be seen to condone the criminal activity of extorting money by taking and threatening the publishing of other people’s data.”
Home Affairs investigating as governments potentially affected
The hack of HWL Ebsworth represents a significant headache for the firm and its clients, which have previously included ANZ, the South Australian, Queensland and ACT governments, the Environment and Human Services Department and the Australian Taxation Office (ATO).
The ABC is not suggesting that these clients have been directly affected by the hack.
However the federal government has confirmed it was a client of the law firm and may have been caught up in the breach.
The Home Affairs department revealed on Friday it set up three “working groups” to respond to the hack.
A spokeswoman said a specialist legal team has already had 10 meetings to discuss the incident and its “potential impact on the government as a user of HWL Ebsworth’s legal services”.
“A Sensitive Information Working Group may be convened to discuss the management of any information exposed in the breach which may be related to vulnerable people, national security and law enforcement matters,” she said.
The spokeswoman also said that another team, dedicated to identity security, may be started to manage any issues around identifiable information and credentials of those affected.
