What happened
Langley Twigg Law, a Napier law firm, said its security monitoring software detected unauthorised activity on its network on 11 January 2026, and that it disconnected the network and engaged its IT provider and forensic specialists [lt-lw], [rnz]. In a notice on its website on 26 January the firm described a “malicious third-party attack” and said a small proportion of its data had been compromised, including internal firm information and some client documents [lt-lw], [rnz].
The Anubis ransomware group claimed responsibility on its leak site on 25 January 2026 and later released what it said was 380 GB of data; that volume is the group’s claim and has not been confirmed by the firm [lt-cyberdaily-update]. Media reported that material the group published included passport scans of employees and clients [cyberdaily], [lt-ib].
Data exposed
The firm said internal firm information and some client documents were involved [rnz]. Passport scans were reported by media from material the group published [cyberdaily]. The number of people affected has not been disclosed and is not estimated here.
Timeline
- 2026-01-11 — The firm’s monitoring detected unauthorised network activity, per the firm [lt-lw].
- 2026-01-25 — Anubis listed the firm on its leak site [lt-lw], [lt-cyberdaily-update].
- 2026-01-26 — The firm published a notice about the incident [lt-lw].
- 2026-01-29 — The Office of the Privacy Commissioner confirmed the firm had been in touch; Police said they were investigating [rnz-opc].
- 2026-02 — The firm obtained a High Court injunction over the data and gave an update on the incident [lt-cyberdaily-update].
Current status
Disclosed. The Privacy Commissioner has been notified; no regulator finding has been reported [rnz-opc]. Figures for data volume are the attacker’s claim [lt-cyberdaily-update]. The firm’s original website notice is no longer online; this record relies on reporting that quotes it.
Why it matters
Small and mid-sized professional-services firms hold highly sensitive client data — identity documents, legal case files — and are a frequent target for data-theft extortion.