{"id":12416,"date":"2020-06-05T14:43:01","date_gmt":"2020-06-05T18:43:01","guid":{"rendered":"https:\/\/www.thesslstore.com\/blog\/?p=12416"},"modified":"2020-06-05T14:43:02","modified_gmt":"2020-06-05T18:43:02","slug":"revils-lessons-its-time-law-firms-quit-taking-cybersecurity-for-granted","status":"publish","type":"post","link":"https:\/\/www.thesslstore.com\/blog\/revils-lessons-its-time-law-firms-quit-taking-cybersecurity-for-granted\/","title":{"rendered":"REvil\u2019s Lessons: It\u2019s Time Law Firms Quit Taking Cybersecurity for Granted"},"content":{"rendered":"\n

More than one-quarter of all law firms have experienced some type of data breach \u2014 here\u2019s what your firm needs to know when it faces a cyber or ransomware attack <\/h2>\n\n\n\n

If you think your law firm\u2019s secure technology is up to date, you might want to think again. The New York entertainment and media law firm Grubman Shire Meiselas & Sacks is the latest victim<\/a> of what seems to be the new norm in the legal representation of high-profile clients.   <\/p>\n\n\n\n

According to an attorney with the firm, Allen Grubman:  <\/p>\n\n\n\n

\u201cDespite our substantial investment in state-of-the-art technology security, foreign cyberterrorists have hacked into our network and are demanding\u00a0<\/em>$42 million as ransom<\/em><\/a>.<\/em>\u201d\u00a0\u00a0\u00a0<\/p><\/blockquote>\n\n\n\n

Law firms are particularly susceptible to these attacks due to the sensitive nature of the\u202fdata\u202fthat they store on behalf of their clients. According to the American Bar Association and the U.S. Department of Justice, 25% of all law firms have been subjected to, or experienced, some form of a data breach involving hackers<\/a>.   <\/p>\n\n\n\n

The average cost of a ransomware attack on a business is\u00a0$133,000<\/a>.\u00a0The\u00a0cost of ransomware attacks<\/a>\u00a0surpassed\u00a0$7.5 billion<\/a>\u00a0in 2019, according to\u00a0Emsisoft.\u00a0Computer-oriented crimes span a wide variety of actions, intentions and goals,\u00a0and no company is too large or too small to be\u00a0affected\u00a0by\u00a0a\u00a0cyberattack.\u00a0This is why cybersecurity for law firms is so important.\u00a0<\/p>\n\n\n\n

So, what is there to know about ransomware attacks on law firms? And what should you do if your firm finds itself facing such a dire scenario?\u00a0<\/strong>\u00a0<\/p>\n\n\n\n

Let\u2019s hash it out.<\/span><\/p>\n\n\n\n

How\u00a0Do\u00a0Ransomware Attacks\u00a0Happen?\u00a0<\/h2>\n\n\n\n
\"Breaking
Let’s take a closer look at how ransomware attacks occur.<\/figcaption><\/figure><\/div>\n\n\n\n

Hackers generally start by accessing your server by using remote desktop protocol credentials deciphered through a brute-force attack. If not through a brute-force attack, hackers are known to gain entry by purchasing remote desktop protocol (RDP) credentials on cybercrime marketplaces<\/a>. <\/p>\n\n\n\n

During the COVID-19 pandemic,\u00a0the number of brute-force attacks on RDP servers has drastically increased<\/a>\u00a0due to the\u00a0record number of employees\u00a0who\u00a0are now working from home.\u00a0This increase in attacks is primarily due to companies rushing to grant remote\u00a0access to their workforce.\u00a0The need to remotely access workstations and servers inevitably\u00a0creates additional vulnerabilities in a firm’s network.\u00a0<\/p>\n\n\n\n

On April 29, 2020, the Department of Homeland Security released updated Microsoft 365 Security Recommendations<\/a>, which highlight the fact that many organizations are rushing to “adapt or change their enterprise collaboration capabilities to meet ‘telework’ requirements” and that organizations “may not be fully considering the security configurations of the platforms they are moving to.” <\/p>\n\n\n\n

After a hacker gains access to a firm’s server, they will map the target network, looking for any sensitive intellectual property, client files, banking information, social security numbers, or other information used for identification.   <\/p>\n\n\n\n

On their way out of your firm\u2019s network, the hackers will infect your server with ransomware. The purpose of installing ransomware is to compel the firm to produce a sum of money in exchange for the return of their clients\u2019 privileged data.  <\/p>\n\n\n\n

In some instances, hackers demand two ransoms: one paid to get your data back, and the other paid to destroy whatever data they may have stolen.  These types of hacks are known as Maze attacks<\/a>.  Payment in these types of hacks is almost exclusively demanded in the form of Bitcoin or some other type of cryptocurrency. <\/p>\n\n\n\n

REvil Ransomware Attacks in 2020 (So Far) <\/h2>\n\n\n\n
\"Cybersecurity<\/figure><\/div>\n\n\n\n

In May 2020, it was announced that the REvil gang \u2014 also known as Sodin and Sodinokibi, which is a ransomware-as-a-service (RaaS) operation \u2014 was able to hack the servers of Grubman Shire Meiselas & Sacks and compromise the law firm’s client information. This means that REvil is allegedly in possession of 756GB of data from the New York law firm’s database<\/a>. <\/p>\n\n\n\n

The hack has compromised the privileged legal contracts of many global celebrities, including “the king,” LeBron James, Jennifer Lopez, and David Letterman. The firm has also represented companies like Facebook, Activision, HBO, Sony, and Vice Media. The stolen data includes confidential contracts, phone numbers, email addresses, personal correspondences, non-disclosure agreements, and more. <\/p>\n\n\n\n

In April 2020, Travelex chose to pay $2.3 million<\/a> \u2014 in the form of 285 Bitcoins \u2014 to the REvil gang after their ransomware attack crippled Travelex’s currency exchange services. Likewise, Allen Grubman is being forced to face a similar reality: comply with the ransomware demands to the tune of $42 million, or compromise the confidential information of his law firm’s most high-profile clients.   <\/p>\n\n\n\n

As of May 14, 2020, Allen Grubman refused to comply or negotiate with the cyber gang known as REvil. According to the law firm<\/a>, the FBI has classified the hack as an act of terrorism. <\/p>\n\n\n\n

But the REvil ransomware gang is not the first hacker group to extort law firms, and it won\u2019t be the last. According to sources, the Sodinokibi ransomware gang appears to be making a killing<\/a>. <\/p>\n\n\n\n

Negotiating Is a Violation of Federal Law <\/h2>\n\n\n\n

Negotiating with a group deemed to be a “cyber terrorists” (or paying that group a ransom) is a violation of federal law. Crimes related to ransomware violate the federal Electronic Communications Privacy Act and the Computer Fraud and Abuse Act<\/a>.   <\/p>\n\n\n\n

Computer hacking is the most common cybercrime investigated by the federal government under the CFAA. Although federal laws can be widely enforced, the federal government usually limits itself to enforcing crimes that cross state lines<\/a> and, more recently, computer crimes considered to be a threat to national security. <\/p>\n\n\n\n

As a criminal defense attorney, it’s hard not to reflect on the parallels in a situation like this. Typically, we would find ourselves on the opposite end of these types of conflicts.\u202f <\/p>\n\n\n\n

In the past, we\u2019ve defended a sports gambling software company accused of conspiring with the mob<\/a>. That case went to trial and was ultimately dismissed. Later, we handled a cryptocurrency hacking case, an online currency arbitrage platform. And, more recently, the alleged illegal deployment of scored Bitcoin ATMs around high crime neighborhoods. <\/p>\n\n\n\n

Charges related to the release, implementation, and spread of ransomware are becoming more common<\/a>. This trend mirrors the rise in ransomware hacks carried out on law firms around the United States and the increased sophistication of these attacks. That is why it is essential for law firms to stop taking their secure technology for granted. <\/p>\n\n\n\n

Your Cyber Insurance May Not Cover This\u2026 <\/h2>\n\n\n\n

As you may have guessed,\u00a0cyber insurance companies<\/a>\u00a0are litigating payouts to law firm policyholders who attempt to claim lost business income related to either:\u00a0<\/p>\n\n\n\n