Ransomware hits law firm counseling Fortune 500, Global 500 companies

Campbell Conroy & O’Neil, P.C. (Campbell), a US law firm counseling dozens of Fortune 500 and Global 500 companies, has disclosed a data breach following a February 2021 ransomware attack.

Campbell’s client list includes high-profile companies from various industry sectors, including automotive, aviation, energy, insurance, pharmaceutical, retail, hospitality, and transportation.

Some of its current and past clients include Exxon, Apple, Mercedes Benz, Boeing, Home Depot, British Airways, Dow Chemical, Allianz Insurance, Universal Health Services, Marriott International, Johnson & Johnson, Pfizer, Time Warner, and many others.

Ransomware attack leads to data theft

“On February 27, 2021, Campbell became aware of unusual activity on its network,” the law firm revealed in a press release issued earlier today.

“Campbell conducted an investigation and determined that the network was impacted by ransomware, which prevented access to certain files on the system.”

The company hired third-party forensic investigators to investigate the incident after discovering the attack and notified the FBI of the security breach.

Campbell issued a press release providing notice because the investigation determined that information relating to affected individuals was accessed by the threat actors behind the ransomware attack. 

While no clear evidence of the ransomware operators accessing specific information for each potentially impacted individual, Campbell confirmed that the affected devices contained various data types.

As Campbell found, the attackers were able to access “certain individuals’ names, dates of birth, driver’s license numbers / state identification numbers, financial account information, Social Security numbers, passport numbers, payment card information, medical information, health insurance information, biometric data, and/or online account credentials (i.e. usernames and passwords).”

Campbell offers 24 months of free access to credit monitoring, fraud consultation, and identity theft restoration services to all individuals whose Social Security numbers or equivalent information was exposed during the attack.

Incident could lead to additional data breaches

Campbell didn’t reveal the identity of the ransomware group behind this attack or if the attackers stole the accessed data.

However, over 20 different ransomware operations are known to steal sensitive files from victims’ servers before deploying payloads and encrypting their victims’ devices.

The data stolen in these attacks is commonly used as leverage to force victims to pay ransoms under the threat of having their information gradually leaked online until the ransomware operators’ demands are met.

Furthermore, in some cases, the ransomware gangs are also increasing the ransom bit-by-bit until all the stolen files are leaked on sites specifically designed for this purpose.

Depending on and if corporate clients’ data was also stolen during the ransomware attack on Campbell’s network, the incident could lead to more data breaches reported in the coming weeks and months.

This week, the US Government launched StopRansomware.gov, an online platform designed to help private and public entities defend themselves from ransomware attacks.

Ransomware has abruptly grown as a threat reaching exceptional levels during the last few months, since the start of 2021.

Attacks have hit US business and critical infrastructure, including the world’s largest meat producer JBS Foods and the largest US fuel pipeline Colonial Pipeline.

More recently, REvil ransomware breached Miami-based MSP software provider Kaseya in a campaign that hit roughly 1,500 businesses worldwide.