ALPHV ransomware group claims 4TB of data from Australian law firm HWL Ebsworth

HWL Ebsworth, one of Australia's largest commercial law firms, said it became aware on April 28, 2023 that the ALPHV group, also known as BlackCat, had posted on a dark web forum claiming to have exfiltrated data from its systems. The firm reported the ransomware incident to the New South Wales government on May 1 and gave initial notification to the Office of the Australian Information Commissioner on May 8.

ALPHV's leak-site post claimed access to roughly four terabytes of firm data. The gang listed employee CVs and identity documents, financial reports, accounting records, client documentation, credit card information and a complete network map among the material it said it held.

HWL Ebsworth said its investigation, conducted with external forensic investigators, found that the attacker had taken information from a confined part of its systems. The firm worked with the Australian Cyber Security Centre and law enforcement, and it declined to pay, saying it had a fundamental civic duty not to encourage the extortion of money by threatening to publish other people's data.

In June 2023 ALPHV published about 1.45 terabytes of the stolen material, more than a million documents, over roughly three weeks. HWL Ebsworth then obtained an injunction from the Supreme Court of New South Wales restraining further publication, a step that was made final in February 2024.