In April, a law firm used by the Victorian Government was hit by a data breach, and documents stolen in the attack have been leaked onto the dark web.
HWL Ebsworth, a Melbourne-based legal firm, was the victim of a threat actor known as ALPHV/BlackCat who has been present on the dark web since April 28, when they made a post on the forum claiming to have “exfiltrated data” from HWL Ebsworth and vowing to release the information if the firm did not comply with their demands.
The data breach has compromised the internal information of multiple government departments and agencies, including the identities of the legal team and clients and confidential documents.
“On June 9, 2023, we discovered that a threat actor had posts on a dark web forum some data they claimed to have taken from a segment of the company’s system, despite not having accessed or removed information from our primary document management infrastructure. The investigation indicated this to be true,” the update reads.
David Cullen, the Victorian Government’s Chief Information Security Officer, asserts the highest priority is to support Victorians who have been affected and to ensure their wellbeing.
“We are taking this matter with the utmost gravity, working cooperatively with the Commonwealth Government, and can verify that no direct incursion of Victorian Government IT systems has occurred,” Mr Cullen said.