HWL ­Ebsworth hack: ‘Sensitive personal and government information’ published on dark web, Darren Goldie reveals

‘Sensitive personal and government information’ has been published on the dark web by a Russian ransomware gang that hacked law firm HWL Ebsworth.

Air Commander Darren Goldie, Cyber Security Coordinator, with Prime Minister Anthony Albanese in Canberra. Picture: NCA NewsWire / Martin Ollman

New cybersecurity tsar Darren Goldie has revealed that “sensitive personal and government information’’ had been stolen and published on the dark web by a Russian ransomware gang that hacked law firm HWL ­Ebsworth.

Mr Goldie, appointed a week ago to the new role of National Cyber Security Co-ordinator, said his first order of business was to obtain briefings from the ­Department of Home Affairs and HWL Ebsworth on the “status of the response’’ to the cyber incident in April.

Russian gang BlackCat, also known as AlphV, hit the giant law firm in April, claiming to have stolen almost four terabytes of data.

The group posted 1.4 terabytes online after the company refused to pay a ransom.

The Australian government has until now said very little about the hack, which is known to have caused deep concern, with the firm representing sensitive agencies including Defence, Home Affairs and the Australian Federal Police, as well as a number of ASX top 50 companies.

“A number of Australian ­government entities were impacted by the HWL Ebsworth cyber incident, with sensitive ­personal and government information released,’’ Mr Goldie said in a statement on social media platform Twitter on Wednesday.

“HWL Ebsworth is working with the department to address the impacts arising from the ­incident.

“HWL Ebsworth is also working with the Office of the Australian Information Commissioner to meet relevant obligations under the Privacy Act 1988.’’

Mr Goldie said he was ­“actively engaging with HWL ­Ebsworth to understand the ­complete picture of this incident, including how their private ­industry clients have been ­impacted, as the data analysis continues’’.

He said HWL Ebsworth’s clients caught up in the hack were now embarking on the process of ­advising “affected individuals’’ about what data had been taken.

“The department’s Legal Services Working Group, comprising representatives from relevant entities across the Australian government, continues to meet regularly to work with HWL Ebsworth on addressing the impacts from the cyber incident for government entities,’’ he said. “Additional co-ordination meetings are occurring to address issues for HWL Ebsworth’s broad­er client base.

“We will work to ensure lessons from this incident are shared so that we can continue to collectively bolster our responses to cyber incidents.’’

Announcing Mr Goldie’s ­appointment on June 23, Home Affairs Minister Clare O’Neil said: “HWL Ebsworth is a very significant incident and the Australian government is deeply concerned about it. I would place it in the realm of the most significant cyber incidents that we’ve experienced as a country over the last year, along with Latitude, Optus and Medibank.’’

The Australian in June revealed the extent of the HWL Ebsworth hack, with the gang said to have stolen documents that sources claimed related to the ADF, the AFP, the Woomera missile site, navy attack helicopter replacement program, enhanced diplomacy in the Indo-Pacific and Solomon Islands, ASIO, police intelligence relating to protests, and immigration detention.

The OAIC also revealed it had lost data, with reports at the weekend indicating that data might relate to the commissioner’s investigations into the Optus hack last year that had ­exposed the data of 10 million Australians.

The Insurance Commission of Western Australia has revealed it had lost data that potentially affects 300 motor vehicle insurance claims.

The NDIS Quality and Safeguards Commission has also lost data, along with the Tasmanian government.

“It should not have taken the appointment of Air Marshall Goldie for the government to finally publicly admit the HWL Ebsworth attack is this serious,” Opposition cyber security spokesman James Paterson said.

“It should have been immediately clear when this breach was first disclosed back in April that it needed to be taken seriously given how many government agencies the firm acts on behalf of.

“The government still needs to ‘fess up which departments and agencies have been affected, and what steps have been taken to secure and protect the sensitive information that they’ve now admitted has been lost.”