What happened
In April 2023 the national law firm HWL Ebsworth was hit by the ALPHV/BlackCat ransomware group, which exfiltrated a large volume of legal and government client documents and later published data when a ransom was not paid [hwle]. The breach reached data linked to around 65 Australian government agencies as well as private clients and individuals [nswgov-hwle]. The total number of individuals affected was not officially quantified and is not estimated here.
Timeline
- 2023-04 — ALPHV/BlackCat ransomware attack; data exfiltrated [hwle].
- 2023-06 — Confirmed impact across government agencies and clients; notifications began [nswgov-hwle].
Current status
Resolved operationally, with extensive government and individual notification. Figures are as reported. [nswgov-hwle]
Why it matters
A landmark supply-chain-style breach: attacking one professional-services firm exposed the sensitive data of dozens of government agencies at once — a defining Australian legal-sector incident.