Mahony Horner Lawyers warned clients of leak after IT provider was hacked

Mahony Horner Lawyers, a Wellington law firm, emailed clients on July 10, 2023 to warn that personal information it held about them may have been copied and could ultimately be leaked. The incident did not originate at the firm. Its IT service provider, Lantech Services, was attacked on May 29, 2023.

The firm notified New Zealand's Office of the Privacy Commissioner on May 30, 2023. The commissioner's office confirmed the notification and said it was working alongside both organizations as they responded to the incident.

Mahony Horner said its priority was confirming exactly what personal information had been copied, a process that was taking time. It had established that copies of client driver licences and passports collected over the previous three years were among the material involved, along with client files. The firm said there was a real risk the data could be leaked and that it would most likely be used in attempted financial fraud.

The firm engaged cybersecurity specialists to monitor for any use or publication of the data and offered to cover the cost of replacing driver licences. It said passports were unlikely to need replacing based on guidance from the Department of Internal Affairs, and that it was otherwise operating as usual.