Henlaw targeted by ALPHV ransomware group

• Ransomware group: ALPHV
• Country: United States
• Sector: Professional Services
• Announcement date: August 5, 2023

The ALPHV ransomware group has issued an announcement on its leak site claiming to have exfiltrated 2.35 TB of data belonging to the law firm Henlaw. The claim, announced on August 5, 2023, suggests a significant breach of the professional services firm's digital infrastructure.

Details of the alleged attack

According to the claims made by the ALPHV group, the breach occurred on August 5, 2023. The group alleges that they successfully obtained 2.35 TB of data from the main servers of Henlaw. In their announcement, the threat actors assert that the security breach was the result of an error made by the firm's IT department.

The group has employed a tactic often seen in modern cyber extortion, where a deadline is imposed to pressure the victim. Specifically, the attackers have demanded that the organization contact them within three days. The group has stated that if these demands are not met within the specified timeframe, the confidential data obtained during the attack will be published on their leak site.

This approach is a hallmark of double extortion, a strategy where attackers not only encrypt a victim's systems but also steal sensitive information. By threatening to release the data publicly, the group aims to exert maximum psychological and reputational pressure on the organization to fulfill their demands.

Data types involved in the breach

The announcement includes screenshots that purportedly show the sensitive information stolen during the operation. The data identified in these screenshots covers a wide range of highly sensitive personal and corporate information. The following types of data are claimed to have been compromised:

• Employee personal data
• Driver's licenses
• ID cards
• Social security numbers (SSN)
• Financial reports
• Credit card information
• Insurance documents
• Legal agreements

The breadth of this data suggests a high level of sensitivity, as it includes both personally identifiable information (PII) and confidential legal documentation.

About Henlaw

Henlaw, formally known as Henderson, Franklin, Starnes & Holt, P.A., is a full-service law firm. Established in 1924, the firm is based in Southwest Florida. With a staff of over 55 attorneys, the firm provides a variety of legal advisory services to both corporate and individual clients.

Implications and sector risks

This breach poses significant risks, particularly regarding identity theft and fraud, for both the employees of the firm and its various clients. Because Henlaw is a United States-based entity, the incident may trigger complex legal processes under relevant state laws and federal data protection regulations. The nature of the professional services sector means that breaches of this type can increase risks related to client confidentiality and broader supply chain security.

The group responsible, ALPHV (also known as BlackCat), is a Ransomware-as-a-Service (RaaS) structure. It was developed using the Rust programming language and emerged in late 2021. Publicly available information regarding the inner workings and specific details of this group remains limited.

For organizations operating in the professional services sector, such incidents highlight the critical importance of robust cybersecurity frameworks. To mitigate the risks of data exfiltration, organizations often implement defensive measures such as multi-factor authentication, strict access controls, and continuous monitoring of network traffic. Furthermore, regular security awareness training can help reduce the likelihood of human error within IT departments, which the attackers in this case claim was the root cause of the breach. Maintaining comprehensive incident response plans is also essential for managing the legal and reputational fallout that follows a major data leak.