Hacker Claims to Have Stolen Files Belonging to Prominent Law Firm Jones Day

quote:

---

Firm disputes network breach; says its file-transfer company was compromised

---

quote:

---

A hacker claims to have stolen files belonging to the global law firm Jones Day and posted many of them on the dark web.

Jones Day has many prominent clients, including former President Donald Trump and major corporations.

Jones Day, in a statement, disputed that its network has been breached. The statement said that a file-sharing company that it has used was recently compromised and had information taken. Jones Day said it continues to investigate the breach and will continue to be in discussion with affected clients and appropriate authorities.

The posting by a person who self-identified as the hacker, which goes by the name Clop, includes a few individual documents that are easily reviewed by the public, including by The Wall Street Journal. One memo is to a judge and is marked “confidential mediation brief,” another is a cover letter for enclosed “confidential documents.” The Journal couldn’t immediately confirm their authenticity.

---

quote:

---

The Journal was able to see the existence of many more files -- mammoth in size -- also purported to belong to Jones Day, posted by the hacker on the so-called dark web. Hackers typically post such stolen information after the hacked entity fails to pay a ransom. The Journal was able to contact the hacker using an email on its blog.

“We have over 100 gigabytes of data,” the hacker wrote in response to an email from the Journal.

The hacker, in the Journal’s correspondence, said it first reached out to Jones Day management on Feb. 3 and informed the firm that its network had been hacked and that data had been stolen. As of Tuesday, the hacker said Jones Day management hasn’t responded but that it believes the law firm received its letters about the attack. The hacker said ransom negotiations haven't begun.

Jones Day, in its statement, said it hasn’t been the subject of a ransomware attack.

Rather, Jones Day said, it has been informed that a company the law firm used to transfer large files electronically, Accellion, “was recently compromised and information taken.” Jones Day said that Accellion is used by many law firms, companies and organizations.

Accellion, Inc. announced on Feb. 1 that its Accellion FTA, a platform for transferring files that it says is near its end of life, was the target of a sophisticated cyberattack. The company said that all FTA customers were promptly notified of the attack on Dec. 23.

However, the hacker told the Journal that it hacked Jones Day’s server directly and that it wasn’t involved in the Accellion hack.

An Accellion spokesman said the company doesn’t comment on individual customers but said it is working with all affected FTA clients to understand and mitigate any impact of this incident.

The Journal was able to review some of the information in Clop’s large files. They include what appear to be Accellion configuration files and logs with references to Jones Day email and web addresses.

Other data in Clop’s tranche appear unrelated to the law firm, however, including medical files from a California hospital victimized by a ransomware attack in 2016, according to the Journal’s review.

Law firms’ computer files often contain confidential information, including the size and nature of settlements, negotiations about pending deals, and legal strategy that would normally be shielded from the public by attorney-client privilege.

The publication of Jones Day’s files was reported by the cybersecurity blog, DataBreaches.net, this past weekend.

With more than 2,500 lawyers around the world, Jones Day had deep ties to the Trump administration. More than a dozen of its lawyers worked in the Trump White House, including Don McGahn, who served as White House counsel and oversaw its judicial selection process before returning to Jones Day in 2019.

Companies hit by hackers and asked for ransom to release their files respond in different ways. Many reach out to law enforcement or the Federal Bureau of Investigation for help. Some companies start to negotiate with the hackers and try to keep the matter quiet; others notify their clients or other affected potential victims to try to prepare them for possible confidential matters becoming public, an approach many cybersecurity experts recommend.

---