Travelex hackers hit celebrity law firm with ransomware
Hackers claim to have compromised 756GB of data including contracts and personal emails
The website for a New York law firm with a large celebrity clientele has been down for almost a week after it was hit with a ransomware attack.
The group claiming responsibility for the attack used the ransomware strain known as Sodinokibi, sometimes also referred to as REvil, the same strain used to take down the Travelex website at the start of the year.
Its latest victim is entertainment and media law firm Grubman Shire Meiselas and Sacks. The attackers claims to have compromised 756GB of data including contracts and personal emails and it's threatening to release the sensitive information in nine instalments.
Data for stars such as Madonna, Lady Gaga and Bruce Springsteen are reported to be included in the hack, which Grubman Shire Meiselas & Sacks confirmed on Friday.
"We can confirm that we've been victimised by a cyberattack," the firm said in a statement to Variety. "We have notified our clients and our staff. We have hired the world's experts who specialise in this area, and we are working around the clock to address these matters."
The company's website was still down on Wednesday, with just the firm's logo on display, and it is unknown what the hacker's demands are and whether they have been negotiated. The damage to the Travelex website kept it offline for weeks and reportedly cost the firm £25 million.
"This breach appears to be a surgical strike against Grubman, knowing they represent many of the biggest celebrities in the world," said Sam Curry, CSO at Cybereason.
RELATED RESOURCE
IT faces new security challenges in the wake of COVID-19
Beat the crisis by learning how to secure your network
"Today, its no longer a matter of if, but when a breach will occur. Every company has been hacked, most many times over, and it comes down to how quickly a company identifies malicious activity and stops it. In the case of Grubman and their large list of A list celebrities, most if not all of them are sweating out the current situation and hoping the damage will be minimal."
-
Ransomware cartels are fragmenting into volatile splinter groups, warns Met Police cyber chiefNews Commoditized "cyber crime bazaars" and AI data mining are forcing law enforcement to rewrite its playbook
-
New ransomware threat group, The Gentlemen, has become one of the most active ransomware operators, accounting for 10% of all attacksNews NTT researchers warn that the RaaS group is leveraging SystemBC malware to establish covert tunnelling, evade detection, and support rapid lateral movement across enterprise environments
-
Instructure chose to a pay ransom following the Canvas cyber attack – research shows more than half of security leaders would follow suitAnalysis Opting to pay ransoms creates huge risks for enterprises – you’re relying on the word of criminals
-
Ransomware negotiator sentenced for role in major cyber crime groupNews Deniss Zolotarjovs was a key player in a group associated with Conti
-
Threat actors ditch ‘spray and pray’ attacks in shift to targeted exploitationNews A dip in ransomware volumes points to a more targeted approach focused on vulnerability exploitation
-
Security leaders overconfident about ransomware recovery
News Few manage to recover all their data, and many experience business disruption
-
German authorities want your help finding the hackers behind GandCrab and REvilNews Daniil Maksimovich Shchukin and Anatoly Sergeevitsch Kravchuk are believed to have made millions from ransomware as a service schemes
-
The rise of teen hackers ‘makes for a good headline’, but cyber crime activities peak later in life
News With family responsibilities and mortgages to pay, it's not teenagers dishing out malware or carrying out cyber extortion
