Ransomware attack on Australian law firm HWL Ebsworth impacts 65 government agencies

Air Marshal Darren Goldie, Australia’s newly appointed national cybersecurity coordinator, revealed that an April ransomware attack against HWL Ebsworth, one of Australia’s largest law firms, had far-reaching consequences.

The attack, attributed to the Russian-speaking Alphv hacking group, also known as BlackCat, led to the compromise of data from 65 Australian government agencies and numerous law firm private sector clients.

Alphv had claimed responsibility for the attack earlier this year. In late May, they released 1.45 gigabytes of stolen data from the law firm. However, HWL Ebsworth only acknowledged the breach in June and took legal action to prevent further dissemination of confidential data.

In his role as the national cybersecurity coordinator, Air Marshal Darren Goldie oversaw a 16-week-long investigation into the incident. The findings revealed that the ransomware attack had entangled data from various Australian government entities. Additionally, many private sector clients who had engaged in the services of HWL Ebsworth were also impacted.

Goldie emphasized that the affected government agencies were the law firm’s clients and did not experience a cyber incident themselves. Among the victims of the attack were notable entities such as the Australian federal police and the Department of Home Affairs.

Alphv is notorious for targeting high-profile organizations with access to highly sensitive data. In April 2022, the Australian Cyber Security Center issued an advisory warning Australian organizations about the potential threat of Alphv attacks.

The timeline of the attack suggests that HWL Ebsworth became aware of the breach as early as April 26 when they received emails initially categorized as spam. These emails, purportedly sent by individuals associated with Alphv, urged the law firm not to involve authorities and demanded an extortion payment of AU$4.6 million. On May 8, HWL Ebsworth took the responsible step of informing the Office of the Australian Information Commissioner about the cyber incident initiating the response process.