Celebrity Law Firm Hacked, Attackers Threaten To Leak Stolen Data

A celebrity law firm has confirmed it has been hacked, and the attackers are said to be threatening to publish sensitive data of some of the biggest names in show business.

The website of New York entertainment law firm Grubman Shire Meiselas & Sacks remains unavailable at the time of writing.

The hackers are said to have stolen 756 gigabytes of data including contracts and personal emails belonging to its clients, who include musicians such as Lady Gaga, Madonna, Bruce Springsteen, Rod Stewart and Elton John. Other clients are said to include Andrew Lloyd Webber, Robert De Niro, Sofia Vergara, Sony Corp and Mike Tyson.

Ransomware attack

The hackers are demanding payment according to the BBC, and are threatening to publish sensitive data unless they are paid.

A screenshot allegedly of a Madonna contract has reportedly already been released.

The law firm has apparently notified its clients and is working with cyber-security experts. But it is not known at this time what sum of money the hackers are demanding, or even if the law firm is negotiating with the attackers.

“We can confirm that we’ve been victimised by a cyber-attack,” the law firm was quoted by the BBC as saying in a statement. “We have notified our clients and our staff. We have hired the world’s experts who specialise in this area, and we are working around the clock to address these matters.”

The attackers are reported to be REvil or Sodinokibi hackers, who most notably crippled foreign exchange company Travelex with ransomware in January.

Desirable target

A security expert warned that law firms such as Grubman Shire Meiselas & Sacks are prime targets for hackers, and they need to bolster their cyber defences to cope with the threat.

“Law firms are increasingly becoming desirable targets of sophisticated cyber gangs,” explained Ilia Kolochenko, founder & CEO of web security company ImmuniWeb. “It is often much easier and faster to breach a mid-sized law firm to get ultra-confidential data compared to targeting its large clients directly, such as banks or celebrities as reportedly happened in this case.”

“In a highly competitive and now digitally-disrupted legal services market, few law firms are prioritising investment into holistic cyber resilience and defense, understand their attack surface, let alone conduct sufficient employee training,” said Kolochenko. “Furthermore, a considerable number of law firms have no incident detection and response capacities, often leaving them unable to detect an intrusion in a timely manner.”

“Worse, modern law firms have to deal with diversified digital flow of sensitive and privileged data on their mobile phone, laptops and office computers,” said Kolochenko. “Partners and clients exacerbate this convoluted landscape by uploading confidential documents to public cloud or file sharing websites.”

“Moreover, even if a data breach is detected, a not insignificant number of law firms would prefer to keep the incident as silent as possible to avoid disastrous reputational damage and acrimonious lawsuits from their clients,” he said. “Ultimately, law firms are a low hanging fruit for cybercriminals, enabling the latter to get their hands on crown jewels of major organisations without spending much effort.”

Do you know all about security? Try our quiz!