Herron Todd White listed on BlackSuit ransomware leak site

• Ransomware group: BlackSuit
• Country: Australia
• Sector: Professional Services
• Announcement date: April 27, 2024

The Australian property valuation firm Herron Todd White has been listed on the leak site of the BlackSuit ransomware group. On April 27, 2024, the threat actors announced the alleged compromise of the organization's data, marking a significant incident involving a major player in the Australian professional services sector.

Details of the alleged attack

According to the announcement made by the BlackSuit group, the threat actors claim to have successfully compromised the data belonging to Herron Todd White. The group alleges that they have obtained a vast amount of information, specifically targeting sensitive databases and corporate documentation. The claims made by the group suggest a large-scale exfiltration of information intended to pressure the organization.

The threat actor alleges that the stolen data consists of several distinct categories and sizes. Specifically, the group claims to have exposed 279 GB of paperwork, 20 GB of database files, and a 3.3 GB compressed archive. This total volume of data, which the group claims to have acquired through their operations, represents a significant portion of the firm's digital assets. No information was provided regarding the specific ransom demand associated with this incident.

Affected data types

The announcement indicates that the following types of information have been exposed:

• Customer databases
• Transaction records
• Corporate documents

About Herron Todd White

Herron Todd White is one of the largest independent property valuation firms in Australia. The company provides property valuation and advisory services, making it a significant entity within the Australian professional services landscape.

Impact and potential consequences

This alleged data breach may increase the risk of identity theft and fraud for the firm's clients. Because the leaked data may potentially be utilized for secondary cyberattacks, the implications for the individuals whose information was compromised are significant. Furthermore, the organization may face legal obligations under Australian data protection regulations following such an incident.

The group responsible, BlackSuit, is considered to be a successor to the Royal ransomware operations. Because of this lineage, the group may be prone to employing double-extortion tactics. Double extortion is a common ransomware strategy where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release. This tactic is designed to maximize the pressure on an organization to pay the ransom, as the threat of a data leak can cause irreparable reputational damage and legal consequences.

The incident could result in negative impacts on the firm's operational continuity and reputation management. For organizations in the professional services sector, maintaining the integrity of client data is paramount to maintaining trust. When dealing with high-value data such as transaction records and client databases, the risk of secondary attacks—where stolen data is used to launch further phishing or social engineering campaigns—is a critical concern for security professionals.

In general, organizations facing such threats often focus on robust defensive measures, such as implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training to mitigate the risk of initial access. However, once data has been exfiltrated, the focus often shifts to incident response and managing the legal and reputational fallout of the exposure.