A&O Cyberattack and Lessons for Law Firms in 2023

LockBit, a notorious Ransomware-as-a-Service group, has garnered attention for its prolific cyberattacks. The assault on Allen & Overy on November 9, 2023, is the most recent in a series of high-profile incidents showcasing the group's audacity. According to the Cybersecurity and Infrastructure Security Agency (CISA), in 2022, LockBit was the most widely deployed ransomware variant worldwide. This move by LockBit has sent shockwaves through the legal community, prompting concerns about data security and leaving many questions unanswered. Here's a closer look at the breach and its implications:

LockBit's Menace

LockBit, a ransomware group that emerged in late 2019, has maintained its destructive momentum into 2023. This year, LockBit has targeted high-profile entities such as Boeing, Royal Mail, and TSMC, the world's largest semiconductor manufacturer. These attacks underscore LockBit's audacity and capacity to breach globally significant organisations, marking them as a prominent cyber threat.

In June, the UK's GCHQ's National Cyber Security Centre (NCSC), in collaboration with security agencies from the United States, Australia, Canada, France, Germany, and New Zealand, released a joint advisory. This advisory highlighted LockBit as the 'most likely the most widespread ransomware variant in the United Kingdom' and emphasised its ongoing status as the primary ransomware threat to organisations in the UK.

Additionally, LockBit, the group responsible for the Allen & Overy (A&O) attack, is infamous for using the Ransomware as a Service (RaaS) model. RaaS enables affiliates to execute ransomware attacks using LockBit's tools and infrastructure. What sets LockBit apart is its extensive network of affiliates, resulting in a diverse array of tactics, techniques, and procedures in their attacks, making them challenging to anticipate and defend against.

The Ransom Demand and Response from A&O:

The LockBit group issued a ransom demand on the dark web, establishing a deadline of November 28. This demand presents Allen & Overy with pivotal decisions on negotiating with the attackers and potentially paying the ransom for data recovery or relying on their cybersecurity measures to restore their systems.

In response, Allen & Overy acted promptly to contain the situation. The firm reported that the incident impacted a restricted number of storage servers. Crucially, the core systems, encompassing email and document management, remained unaffected. However, the measures to contain the attack resulted in some operational disruption.

The law firm swiftly mobilised its technical response team, collaborating with an independent cybersecurity advisor, to isolate and mitigate the incident. Ongoing extensive forensic work aims to assess the full extent of the breach, and the firm is currently notifying clients whose data may have been compromised.

Lessons for Law Firms

This cyber incident coincides with a critical juncture for Allen & Overy, given its recent confirmation of a high-profile merger with Shearman & Sterling. Although there is no direct link between the merger and the attack, the incident underscores the imperative for heightened data security during transitions and partnerships.

Allen & Overy's dedication to safeguarding client data remains steadfast. A spokesperson from the firm stressed, "Ensuring the safety, security, and confidentiality of our client's data is an absolute priority." In the legal sector, where sensitive information is the lifeblood of operations, addressing the growing challenge of protecting against cyber threats is paramount.

In the aftermath of this breach, the legal community is confronted with sobering lessons on the susceptibility of law firms to cyberattacks. The incident emphasises the critical need for robust cybersecurity measures, comprehensive employee training, and proactive monitoring to forestall future breaches.

The cyberattack on Allen & Overy also serves as a stark reminder of the mounting threat posed by ransomware groups like LockBit, adept at exploiting security weaknesses across various industries. This underscores organisations' need to adapt and fortify their defences against evolving cyber threats.