Optus Suffers Another Breach Due To A BlackCat Ransomware Attack On HWL Ebsworth’s Network

Australian telecommunications company Optus suffered yet another data breach as a result of hackers stealing sensitive data from law firm HWL Ebsworth’s computer systems.

Earlier this year, HWL Ebsworth said that on 28th April, the notorious ALPHV/BlackCat ransomware gang uploaded a post on the dark web forum claiming to have infiltrated its internal systems and stolen vast amounts of data.

The law firm said it immediately engaged cyber security experts McGrathNicol to investigate the security incident and determine the scope of the same.

“The investigation indicates the threat actor had accessed and exfiltrated certain information on a confined part of the firm’s system, but not on our core document management system,” it said.

Optus recently said that it suffered yet another data security incident as a result of threat actors infiltrating HWL Ebsworth’s internal network and stealing almost 4 terabytes of data.

While Optus is yet to confirm whether the compromised data includes its customer information or personal details, reports suggest that some data related to an investigation launched in 2021 by the Office of the Australian Information Commissioner (OAIC) into Optus was compromised by the security incident.

Acknowledging the reports of the data breach, Optus said it has asked the OAIC to “clarify the extent to which Optus information has been affected in this data breach involving files held by HWL Ebsworth”.

While HWL Ebsworth has not commented on the extent to which Optus was impacted by the cyber security incident, the firm said that it is conducting a “detailed and comprehensive review of the impacted data and informing impacted third parties and individuals as swiftly as it can”.

“We have an ongoing engagement with relevant authorities in relation to this process, including the Office of the Australian Information Commissioner,” HWL Ebsworth said.

Last year, Optus said it suffered a significant cybersecurity incident that involved threat actors gaining unauthorised access to its internal network. As soon as the unauthorised access was discovered, Optus said it acted promptly to stop the cyber attack before it could spread any further.

The company later said that out of the 9.8 million customers whose data was accessed by the threat actor, 2.1 million customers had at least one of their identity documents accessed. Around 1.2 million individuals had their current IDs compromised and for the remaining 900,000 individuals, their expired IDs were compromised.