MacGillivray Law listed on meow ransomware leak site

• Ransomware group: meow
• Country: Canada
• Sector: Professional Services
• Announcement date: September 30, 2024

The Canadian law firm MacGillivray Law has been listed on the meow ransomware group's leak site. The threat actor claims to have exfiltrated 110 GB of data belonging to the firm's operations and personnel.

The claims of the meow ransomware group

On September 30, 2024, the meow ransomware group announced that it had targeted MacGillivray Law. According to the group's announcement, the threat actor has successfully exfiltrated a significant volume of data, totaling 110 GB. This data is claimed to encompass both the firm's operational files and sensitive information regarding its personnel.

The group has initiated a double extortion tactic, a common method in modern ransomware attacks where threat actors not only encrypt an organization's systems but also steal sensitive data to leverage for ransom. In this instance, the group has placed the stolen data up for sale on their leak site. The ransom demand has been set at 40,000 USD for a single buyer, while a discounted price of 20,000 USD is offered if the data is sold to multiple buyers.

The allegedly stolen data

The announcement made by the meow group claims that the stolen dataset is extensive and contains a variety of sensitive documents and databases. The information allegedly includes:

• Employee data
• Client information
• Payment documents
• Contracts and agreements
• SQL databases
• Personal data (including dates of birth, driver's license scans, and more)
• Business proposals
• Internal financial documents

The presence of such diverse data types, ranging from personal identifiers like driver's license scans to internal financial records and SQL databases, suggests a broad compromise of the firm's digital environment.

About MacGillivray Law

MacGillivray Law is a Canadian law firm that specializes in personal injury and insurance litigation. The firm maintains a presence across multiple regions, with offices located in Nova Scotia, New Brunswick, and Newfoundland. Their professional services focus on providing legal support to victims of injuries and assisting clients through the complexities of insurance claim processes.

Potential impact and risks

This alleged leak may pose a significant risk of exposure for sensitive personal and financial information belonging to the law firm's clients. Given the highly confidential nature of legal client information, such a breach could have negative impacts on the firm's reputation. Furthermore, the exposure of personal data, such as dates of birth and driver's license scans, creates secondary risks, including the potential for identity theft and targeted phishing attacks against both clients and employees.

From a regulatory perspective, the firm may face mandatory breach notification requirements and potential legal consequences under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). Organizations in the professional services sector, particularly those handling sensitive legal and personal data, often face these heightened risks during cyberattacks.

While public information regarding the meow group remains limited, this incident highlights the ongoing threat posed by ransomware groups targeting specialized service providers. Organizations typically defend against such threats by implementing robust security frameworks, maintaining offline backups, and ensuring strict access controls to sensitive databases and client files.