On 28 April 2023, HWLE Lawyers (HWLE) became aware that a cyber-crime threat actor group identified as ALPHV/BlackCat made a post on a dark web forum claiming to have exfiltrated data from the firm.

Investigations by HWLE and McGrathNicol indicated that the threat actor group had taken certain information from a confined part of the firm’s system. For a three-week period in June 2023, some of the data was published on the threat actor’s dark web forum.

Investigation & response

HWLE completed a detailed analysis of all data that was accessed by the criminals. As the data set was large and unstructured this was a detailed and complex challenge.

Our priority was to ensure that we properly reviewed the data and notified impacted organisations and individuals as quickly as possible. While that process took some time to work through, it is now complete.

We worked closely with the government and relevant authorities – including the Australian Cyber Security Centre and law enforcement agencies in their investigation into the incident.

We formally notified the incident to the Office of the Australian Information Commissioner (OAIC) and kept them updated during the process of notifying impacted individuals.

Injunction to protect individual & impacted parties

HWLE took the step, unprecedented in Australia, of obtaining an injunction from the Supreme Court of New South Wales, seeking to restrain further publication or dissemination of confidential information.

The injunction was sought to protect the interests of impacted entities and individuals. The injunction was originally granted in June 2023 on a temporary basis and was made final in February 2024 - see judgment here: HWL Ebsworth Lawyers v Persons Unknown [2024] NSWSC 71.

Information for individuals

The privacy and security of our client and employee data is of the utmost importance.

HWLE appreciates the patience and understanding of those affected as we worked through the impact of this incident. Working together with impacted organisations, we have been through the process of contacting affected individuals to provide information about the breach and offer direct assistance and support services.

If you are an individual for whom HWLE has acted or you have otherwise been involved in a matter in which HWLE acted, and you are concerned your personal information may be affected but you have not received a notification, please email hwlecyberhelp@hwle.com.au with your query. We will be able to clarify whether or not you are impacted and provide you with further assistance and details of support services as necessary.

If you have any other queries, including in relation to the support that is available if you have been told you are impacted, please email hwlecyberhelp@hwle.com.au.