Celebrity Law Firm Hacked, Attackers Threaten To Leak Stolen Data

A celebrity law firm has confirmed it has been hacked, and the attackers are said to be threatening to publish sensitive data of some of the biggest names in show business.

The website of New York entertainment law firm Grubman Shire Meiselas & Sacks remains unavailable at the time of writing.

The hackers are said to have stolen 756 gigabytes of data including contracts and personal emails belonging to its clients, who include musicians such as Lady Gaga, Madonna, Bruce Springsteen, Rod Stewart and Elton John. Other clients are said to include Andrew Lloyd Webber, Robert De Niro, Sofia Vergara, Sony Corp and Mike Tyson.

Ransomware attack

The hackers are demanding payment according to the BBC, and are threatening to publish sensitive data unless they are paid.

A screenshot allegedly of a Madonna contract has reportedly already been released.

The law firm has apparently notified its clients and is working with cyber-security experts. But it is not known at this time what sum of money the hackers are demanding, or even if the law firm is negotiating with the attackers.

“We can confirm that we’ve been victimised by a cyber-attack,” the law firm was quoted by the BBC as saying in a statement. “We have notified our clients and our staff. We have hired the world’s experts who specialise in this area, and we are working around the clock to address these matters.”

The attackers are reported to be REvil or Sodinokibi hackers, who most notably crippled foreign exchange company Travelex with ransomware in January.

Desirable target

A security expert warned that law firms such as Grubman Shire Meiselas & Sacks are prime targets for hackers, and they need to bolster their cyber defences to cope with the threat.

“Law firms are increasingly becoming desirable targets of sophisticated cyber gangs,” explained Ilia Kolochenko, founder & CEO of web security company ImmuniWeb. “It is often much easier and faster to breach a mid-sized law firm to get ultra-confidential data compared to targeting its large clients directly, such as banks or celebrities as reportedly happened in this case.”

“In a highly competitive and now digitally-disrupted legal services market, few law firms are prioritising investment into holistic cyber resilience and defense, understand their attack surface, let alone conduct sufficient employee training,” said Kolochenko. “Furthermore, a considerable number of law firms have no incident detection and response capacities, often leaving them unable to detect an intrusion in a timely manner.”

“Worse, modern law firms have to deal with diversified digital flow of sensitive and privileged data on their mobile phone, laptops and office computers,” said Kolochenko. “Partners and clients exacerbate this convoluted landscape by uploading confidential documents to public cloud or file sharing websites.”

“Moreover, even if a data breach is detected, a not insignificant number of law firms would prefer to keep the incident as silent as possible to avoid disastrous reputational damage and acrimonious lawsuits from their clients,” he said. “Ultimately, law firms are a low hanging fruit for cybercriminals, enabling the latter to get their hands on crown jewels of major organisations without spending much effort.”

Do you know all about security? Try our quiz!

Tom Jowitt

Tom Jowitt is a leading British tech freelancer and long standing contributor to Silicon UK. He is also a bit of a Lord of the Rings nut...

Recent Posts

Amazon Alexa Recovers After Morning Outage

Alexa wake up alarm didn't work this morning? Smart lights didn't turn on? Outage of…

2 days ago

UK, Australia Reach Cyber, Critical Tech Agreement

Australia says it will 'fight back' against nation state cyberattacks, after agreements with the UK…

2 days ago

Italian Regulator Recalculates Apple, Amazon Fines

Italian regulator admits it has redetermined the fines against Apple and Amazon, over the sale…

3 days ago

Red Cross ‘Appalled’ As Hackers Steal Humanitarian Data Of 515,000 People

A new low. International Committee of the Red Cross shuts down reunification system, after hackers…

3 days ago

Russia Proposes Ban On Cryptocurrencies, Crypto Mining

Russia's central bank has this week proposed the banning on the use and mining of…

3 days ago