Legal tech firm Casepoint investigates data breach following hacker claims

Casepoint, a prominent legal discovery technology company, is investigating a potential data breach after claims made by the BlackCat/ALPHV ransomware group surfaced on a hacking site.

 

The group asserted that it successfully hacked Casepoint, compromising more than two terabytes of data, including sensitive information from various lawyers and organizations such as the SEC, DoD, FBI, and Police.

 

The company promptly activated its incident response protocols after learning of the alleged breach. It engaged an external forensic firm to aid in the investigation process, offering additional expertise in identifying potential vulnerabilities and overseeing remediation efforts.

 

Casepoint provides its services to high-profile clients, including the United States Courts, SEC, DoD, the US National Credit Union Administration (NCUA), Marriott, ThyssenKrupp, Mayo Clinic, BNSF Railway, and others.

 

“We take the security of our clients’ data very seriously, and we are actively working to assess the situation and respond accordingly,” stated a spokesperson from Casepoint. The company’s eDiscovery platform remains fully operational, and clients are assured that their services will not be disrupted.

 

However, the absence of service interruption does not definitively rule out the involvement of ransomware in the attack, as organizations often initiate security measures even in cases where system penetration is unlikely.

 

While Casepoint continues to investigate the breach, the BlackCat/ALPHV group has issued a demand for communication from the company. The group has threatened to publish the compromised data on their blog if Casepoint fails to comply. Some reports have claimed that the group has released certain data purportedly linked to Casepoint’s platform.

 

BlackCat/ALPHV initially gained attention in 2021 and resurfaced in April when it targeted NCR Corp, a retail point-of-sale and automatic teller machine technology company. The attack on NCR involved ransomware and resulted in a service outage for the company.