In April 2023, ALPHV/BlackCat ransomware exfiltrated 4 terabytes of data from HWL Ebsworth, one of Australia's largest law firms, including data belonging to 65 federal government agency clients. This report examines how law firms function as unintended data aggregators for their clients, and why the legal sector's cybersecurity posture creates systemic risk for governments and corporations alike.
Marco Cavani
Cybersecurity Analyst
In April 2023, HWL Ebsworth, one of Australia’s largest national law firms, was attacked by the ALPHV/BlackCat ransomware group. The attackers exfiltrated approximately 4 terabytes of data from the firm’s systems and demanded a ransom. HWL Ebsworth declined to pay.
In June 2023, ALPHV began publishing stolen data on its dark web blog. The published files included internal firm documents, client correspondence, financial information, and case files. Among the clients whose data was exposed were more than 65 Australian federal government agencies, including the Reserve Bank of Australia, the Australian Federal Police, the National Disability Insurance Agency, and multiple departments.
The HWL Ebsworth incident illustrates a systemic risk in the relationship between law firms and their institutional clients: law firms hold significant volumes of sensitive client data, including government policy documents, litigation strategy, contract drafts, and regulatory correspondence, but typically have weaker cybersecurity controls than the government agencies and corporations that are their clients.
The result is that a law firm functions as an unintended data aggregator: a single point where data from dozens or hundreds of clients can be accessed by an attacker who successfully compromises the firm.
Date: April 2023
Organisation: HWL Ebsworth Lawyers (one of Australia’s largest national law firms by revenue and partner count)
Data exfiltrated: Approximately 4 terabytes
Clients affected: 65+ federal government agencies and numerous private sector clients
Attack group: ALPHV/BlackCat (a ransomware-as-a-service operation)
Ransom: Demanded; HWL Ebsworth declined to pay
Data publication: ALPHV published stolen data from June 2023 onward; data included government agency documents, case files, and internal firm communications
Regulatory response: Australian government agencies notified; OAIC notified; Parliamentary committee reviewed the incident’s implications for government data shared with law firms
HWL Ebsworth has not publicly disclosed the specific technical entry vector for the ALPHV attack. Based on the ALPHV group’s known operational methods and publicly available indicators, the attack likely involved one of the following entry vectors:
Phishing and credential compromise: ALPHV regularly uses spear-phishing campaigns targeting employees of victim organisations, harvesting credentials that are then used to establish persistent access before the ransomware deployment phase.
VPN or remote access exploitation: ALPHV has exploited vulnerabilities in VPN appliances and remote desktop services. Law firms that operate remote access infrastructure for partners and staff working remotely represent a potential entry vector.
Initial Access Broker purchase: ALPHV and other sophisticated ransomware groups purchase initial access to victim networks from “initial access brokers” who specialise in establishing persistent footholds in target networks and selling that access. If HWL Ebsworth had experienced a prior credential compromise, the access may have been sold before the ALPHV deployment.
Regardless of the entry vector, the subsequent steps are consistent with ALPHV’s documented methodology: establish persistence, escalate privileges, perform network reconnaissance, identify and exfiltrate high-value data, then deploy the ransomware payload.
The 4TB exfiltration timeline: ALPHV-affiliated actors typically spend weeks in a victim network before ransomware deployment, during which time data exfiltration occurs. The 4TB volume suggests an extended data collection period during which the attacker harvested files from the firm’s document management system, email archive, and shared storage.
The most significant systemic risk illustrated by the HWL Ebsworth incident is not specific to any individual control failure but to the structural role of law firms in the information ecosystem.
A large national law firm like HWL Ebsworth provides legal services to dozens or hundreds of government agencies and corporations simultaneously. In the course of providing those services, it holds:
Privileged client communications: Legal advice is protected by legal professional privilege, but that privilege does not protect the documents from being stolen. The correspondence between a government agency and its legal advisers about ongoing litigation, regulatory strategy, or policy disputes is sensitive regardless of its privileged status.
Draft contracts and transaction documents: A law firm advising on an acquisition, a government procurement, or a regulatory negotiation holds drafts that reveal the client’s position, priorities, and red lines.
Regulatory and litigation strategy: Law firms advising clients in regulatory investigations or litigation hold strategy documents that, if disclosed to the opposing party, would be enormously damaging.
Personnel and employment data: Employment law matters bring HR files, disciplinary records, and personal data of employees into the law firm’s possession.
Government policy documents: Agencies that seek legal advice on proposed legislation or regulation send the policy documents, draft legislation, and political context to their lawyers.
The attacker who compromises a large law firm with 65+ government agency clients does not need to compromise 65 separate government agencies. They compromise one firm and receive the data of all 65.
Ransomware Detection and Response: The successful deployment of ALPHV ransomware following an extended dwell period indicates that the firm’s detection capabilities did not identify the attacker’s presence during the reconnaissance and exfiltration phase. Endpoint detection and response, SIEM monitoring, and user behaviour analytics are the controls that detect lateral movement and data exfiltration before ransomware deployment.
Data Exfiltration Prevention: 4TB of data leaves a network over time, not instantaneously. DLP controls calibrated to detect bulk file access and transfer from the document management system to external destinations would have detected and potentially blocked the exfiltration.
Client Data Segregation: A law firm’s document management system that stores all client files in a common system, accessible to any employee with general system access, does not provide the segregation that would limit a compromised credential to the client matter files relevant to that credential holder’s work. Client matter files should be accessible only to the team working on those specific matters.
Multi-Factor Authentication and Remote Access Security: The entry vector, whether phishing or VPN exploitation, typically bypasses weak authentication. MFA on all remote access pathways and on the document management system reduces the value of a stolen credential.
Third-Party Security Assessment from the Client Perspective: Government agencies and corporations that share sensitive data with law firms should include the law firm’s cybersecurity posture in their third-party risk assessment program. A government agency that assesses its IT vendors but not its external legal panel is inconsistent in its third-party risk management.
The HWL Ebsworth breach prompted Australian government agencies to review the data they share with external law firms and the controls that govern that sharing.
The systemic risk is clear: government agencies are subject to rigorous cybersecurity requirements through the Australian Government Information Security Manual (ISM) and the Protective Security Policy Framework (PSPF). External law firms are not subject to these requirements. When an agency sends sensitive documents to external counsel, those documents move from a regulated security environment to an unregulated one.
The government’s response options include:
Security assessment requirements for legal panel firms: Require law firms on government legal services panels to demonstrate cybersecurity maturity through a defined assessment process, similar to the requirements applied to IT service providers.
Secure file sharing platforms: Government agencies that share sensitive documents with external counsel should use government-operated or government-approved secure file sharing platforms rather than email attachments.
Classification marking and handling requirements: Documents shared with external counsel should carry classification markings that require the recipient to handle them in accordance with the originating agency’s security requirements.
Implement client matter access segregation in document management. Files for each client matter should be accessible only to the team assigned to that matter. A junior paralegal working on a commercial matter should not be able to access the government litigation files in the same system.
Deploy EDR and SIEM with specific alerting for bulk document access. Law firm document management systems are the high-value target in a ransomware attack. EDR and SIEM monitoring that establishes a baseline for normal document access patterns and alerts on bulk access or export events provides the detection layer that identifies an attacker in the exfiltration phase.
Require MFA on all systems holding client files. No system in a law firm that holds client documents should be accessible with a username and password alone. This is the single highest-impact control for reducing the risk of a credential compromise reaching client data.
Include law firm cybersecurity in client vendor risk assessments. Corporations and government agencies that share sensitive data with external law firms should require security attestation or assessment as a condition of panel membership. The security posture of the firm is part of the engagement risk.
Develop an exfiltration response plan. If data is exfiltrated before ransomware is deployed, the relevant decision is not just whether to pay but how to notify affected clients and what obligations arise under the Privacy Act and professional conduct rules. A pre-planned response reduces the time pressure on these decisions.
The ITGC controls most directly implicated in this incident map to the following audit testing areas:
Written by
Marco Cavani
Cybersecurity analyst and IT governance professional. Author of digital reports on threat intelligence, critical infrastructure security, and IT audit frameworks.
In November 2023, a cyberattack forced DP World Australia to take its port operations offline for four days, stranding 30,000 containers at four major Australian ports. The incident demonstrated that a single managed logistics provider's security posture could be leveraged to disrupt 40 percent of Australia's container port capacity.
On 12 May 2017, WannaCry ransomware encrypted devices across 80 NHS organisations in England, forcing the cancellation of at least 19,000 appointments and procedures. This report examines how a nation-state-developed exploit became a criminal weapon and what it exposed about patch management and network segmentation in public health infrastructure.
On 5 February 2021, an attacker remotely accessed the control system of the Oldsmar, Florida water treatment plant and raised the sodium hydroxide concentration to 111 times the safe level. An alert operator noticed the cursor moving and reversed the change. This near-miss exposed the open remote access vulnerabilities common in small water utilities across the US.
Get the latest cybersecurity reports, threat intelligence, and IT governance insights delivered straight to your inbox. No spam. Unsubscribe any time.
No spam. Unsubscribe at any time.
The RACM ITGC SaaS platform helps audit professionals manage IT General Controls assessments, from risk and control mapping to workpaper generation and evidence tracking.
