South Australian government agencies linked to HWL Ebsworth data breach as a dozen people told of sensitive data breach

South Australians have been told their sensitive data could be in the hands of Russian hackers after several government departments revealed they used cyber attack target HWL Ebsworth.

The State Government has notified 12 South Australians that their data may be in the possession of Russian hackers as it can be revealed that law firm HWL Ebsworth had been used by several government agencies.

Over the weekend large swathes of data stolen from HWL Ebsworth during a cyber attack were found to include sensitive documents from the Victorian state government.

Tasmania and Queensland have both confirmed that sensitive information was in the hands of the law firm.

On Saturday, a South Australian government spokesman said that they were working with the Commonwealth Department of Home Affairs to limit the exposure of departments which had used the law firm.

“HWL Ebsworth has been used by a small number of State Government agencies,” he said.

Ransom demands sent to law firm HWL Ebsworth after 4 terabytes of data stolen by Russian hackers. Source: Supreme Court of NSW

“Analysis so far reveals the State Government’s exposure to this data breach is not widespread.

“So far, 12 individuals have been notified that they may have been impacted.

“Analysis of the impact of this data breach is ongoing and the State Government will continue to notify relevant parties where necessary.”

HWL Ebsworth was the target of a major cyber attack in April by a Russian linked hacking consortium known as ALPHV or Blackcat.

The Australian Cyber Security Centre believes ALPHV has been active on a global stage since 2021 and operates a business offering Ransomware-as-a-service, or RaaS.

In exchange for a percentage of profits the predominantly Russian speaking group offers ransomware programs and services to clients.

Ransomware allows for information and documents to be stolen and then ransomed back to the user.

The ACSC has reported that members of ALPHV are likely to have been recruited from other, now defunct, Russian affiliated ransomware gangs.

In late April the group posted online that it had stolen 3.6TB of data from HWL Ebsworth and demanded a cash ransom.

Earlier this month a 1.1TB segment of the information was published online, including sensitive documents from Victorian State Government agencies.

An email showing the ransom demand sent to law firm HWL Ebsworth. Source: Supreme Court of NSW

HWL Ebsworth is a large law firm with offices in all capital cities.

The Guardian has reported that the law firm has been used by at least 60 departments and government agencies.

In a statement released on Friday, a HWL Ebsworth spokesperson said the data set stolen was “large and unstructured and includes a complex mix of different types of documents and information, affecting many different stakeholders”.

“Since day one, we have worked closely with the government and all relevant authorities – including the Australian Cyber Security Centre and law enforcement agencies in their ongoing investigation into the incident,” they said.

“We have formally notified the incident to the Office of the Australian Information Commissioner and continue to keep them updated.”