Share this article on:
The Auckland-based law firm Hudson Gavin Martin has confirmed it was the victim of a cyber attack after being listed as a victim on the darknet leak site of the RansomHub ransomware gang.
Ransomhub posted details of the hack on 25 February and claims to have stolen 30 gigabytes of data, which the gang aims to publish sometime later today, 28 February.
The affiliate responsible for the attack has not shared any other details of the incident or provided any evidence of the hack.
However, a spokesperson for Hudson Gavin Martin has confirmed that the firm is aware of the hackers’ claims.
“We recently experienced a cyber incident during which an unauthorised third party accessed a limited part of our IT system,” a Hudson Gavin Martin spokesperson told Cyber Daily.
“As soon as we detected the incident, we took immediate steps to secure our system, and engaged cyber security experts to begin an investigation into the nature and extent of data that may have been accessed. This investigation is ongoing.
“The systems that hold the majority of our client information and files were not impacted, but unfortunately, our investigation has identified that personal information belonging to a handful of our team members and a small number of our clients may have been affected, along with a limited amount of client data.”
Hudson Gavin Martin is now in the process of notifying its clients and employees affected and providing them with support to “help them protect their information”.
“We have also provided a preliminary notification to the New Zealand Office of the Privacy Commissioner, in line with our obligations,” Hudson Gavin Martin said.
“As our investigation continues, we will continue to communicate with all our stakeholders in a timely and transparent manner. We remain committed to protecting all information we hold, and we sincerely apologise for any concern this incident has caused.”
Hudson Gavin Martin provides legal services covering technology, media, and intellectual property law.
RansomHub first emerged as a ransomware-as-a-service operation in February 2024 and has since become one of the most active criminal threat actors. The gang and its affiliates have claimed 696 victims to date, with its most recent victim in the ANZ region being ASIC compliance firm Waive, which was listed by the gang on 30 November last year.
David Hollingworth has been writing about technology for over 20 years, and has worked for a range of print and online titles in his career. He is enjoying getting to grips with cyber security, especially when it lets him talk about Lego.