Reports indicate that the personal data of numerous clients from three major law firms in the United States might have been compromised due to a large-scale global data breach. Last month, Kirkland & Ellis, K&L Gates, and Proskauer Rose, along with 50 other multinational corporations, were targeted by a ransomware group known as Clop, which claimed responsibility for the hacking incident.
The vulnerability that led to the exposure of the law firms was found in the MOVEit software, which is commonly used for file transfers. The hackers, who identify themselves as “Lance Tempest” and are associated with Clop (also known as TA505), exploited this software vulnerability during the Memorial Day weekend, as reported by sources.
Bleeping Computer, an information security and technology news site, highlighted that the Clop group has a tendency to carry out attacks during holidays.
Cypfer, a team specializing in internet ransomware negotiation, stated that this group, believed to have ties to Russia, typically demands substantial sums of money for extortion.
Recently, the US State Department offered a $10 million reward for information leading to the identification of the group’s leader, as they suspect a potential connection between the group and a foreign government.
The breach of the law firms’ data was a direct consequence of the vulnerability found in the MOVEit software used for file transfers, according to reports. Cybersecurity expert Brett Callow indicated in a tweet earlier this week that the breach could potentially impact over 16 million individuals.
Apart from targeting the law firms, the attacks also affected universities, banks, and insurance companies worldwide, as confirmed by Callow. However, as of now, there has been no response to emails sent to the New York offices of the law firms involved in the breach.
