WA’s Legal Practice Board hack sees bank details of legal firms stolen as police investigate ‘cyber incident’

WA’s Legal Practice Board — the professional body that investigates dodgy lawyers and holds some of the judiciary’s most sensitive secrets — has been hacked by a global ransonware gang called Dire Wolf. Bank details of legal firms have been stolen and WA’s 8000 lawyers are waiting on tenterhooks to see whether files on confidential investigations and disciplinary action have been compromised and could be made public. Dire Wolf, which promotes itself as “a group of hackers who only seek money, no morals, no political stance, no LGBT” plans to publish half the stolen data on June 15. The remaining information will be leaked on June 30. WA Police is investigating and the board has notified the State’s lawyers, who must be recertified by the board every year. “From our investigations to date, we have confirmed that a small amount of information was taken from the board’s systems,” the board said in a note to members said. “This information consists of corporate correspondence containing minimal contact information; bank account details for the board and legal practices; and some operational and re-sourcing information.” The board has taken the unusual step of obtaining a court-ordered injunction “to prevent access, dissemination or sharing of the impacted data”. “This is part of our efforts to ensure we are taking all available steps to protect any information potentially impacted by this incident,” the board said in its note. “We do not have any credible evidence to conform at this point of our investigation that the unauthorised third party possess any other board data although we are reviewing what could have been accessed as a priority.” The board said WA Police, the Department of Premier and Cabinet’s cybersecurity division and the Australian Cyber Security Centre had been alerted. The Legal Practice Board is an “independent statutory authority“, meaning its powers are enshrined in legislation but it operates at arms-length from government. WA’s two most senior law officers — Attorney-General Tony Buti and Solicitor-General Craig Bydder — sit on the board. It is chaired by veteran commercial property lawyer John Syminton. The application for the injunction was made in the NSW Supreme Court. It bans anyone from “placing any material from the impacted dataset . . . at any location on the internet; transmitting, publishing or disclosing any of the impacted dataset to any person or facilitating such steps; using (including viewing) any information from the impacted dataset already in their possession for any purpose . . . promoting or publishing any links to locations from which the impacted dataset may be able to be downloaded, without the plaintiff’s written consent”. In a statement to The West Australian, the board said it “would like to assure our stakeholders that we have not detected any impact to personal sensitive information at this time. We took some systems offline on May 21 when we detected some unusual activity on our network. “We became aware of the online post by a group called Dire Wolf yesterday (May 27).” Cybersecurity website Cyberdaily.au reported Dire Wolf “claims to utilise double-extortion techniques, both stealing and threatening to publish data, and encrypting that data, forcing victims to pay a ransom in order to purchase a decryptor to unlock their files”. “Dire Wolf’s contact page claims that the gang is based in New York. The copy on the site suggests that the hackers are at least familiar with English, if not native English speakers,” Cyberdaily.au said. The Legal Practice Board joins a long list of organisations who have fallen victim to cybercriminals this year, including superannuation giant AustralianSuper.