What happened
In April 2023 the national law firm HWL Ebsworth was hit by the ALPHV/BlackCat ransomware group [hwle]. Some of the data was posted on the threat actor’s dark-web forum for about three weeks in June 2023 [hwle]. The National Cyber Security Coordinator said 65 Australian Government entities were affected, as well as private clients and individuals [itnews-hwle-65]. HWL Ebsworth obtained an injunction restraining use or publication of the data (temporary in June 2023, final in February 2024) [hwle]. The total number of individuals affected was not officially quantified and is not estimated here.
Timeline
- 2023-04-28 — HWL Ebsworth became aware of a dark-web claim that its data had been stolen [hwle], [nswgov-hwle].
- 2023-05-08 — Notifiable data breach notification made to the OAIC [hwle], [nswgov-hwle].
- 2023-06-09 — The threat actor claimed to have published about 1.4 TB of data [nswgov-hwle].
- 2023-06-15 — OAIC published a statement on the breach [oaic-hwle-stmt].
- 2023-09 — National Cyber Security Coordinator said 65 Australian Government entities were affected [itnews-hwle-65].
- 2024-02-21 — OAIC opened a formal investigation into HWL Ebsworth’s security of personal information and notification of individuals [oaic-hwle-inv].
Current status
Under OAIC investigation; no conclusion or determination has been published [oaic-hwle-inv]. HWL Ebsworth says notifications to affected individuals have been completed [hwle]. Figures are as reported.
Why it matters
A landmark supply-chain-style breach: attacking one professional-services firm exposed the sensitive data of dozens of government agencies at once — a defining Australian legal-sector incident.