Foley & Lardner this month experienced what it called a “cyber event” that disrupted its information technology systems despite no client data being accessed, a spokeswoman for the Am Law 100 firm said in an email.
The incident, first reported last week by Bloomberg, is a reminder to law firms that they remain high-priority targets of hackers, ransomware and, more recently, nefarious miners of cryptocurrency.
“We have security safeguards in place designed to protect our systems and data and have confirmed no unauthorized access to client data,” said Foley & Lardner spokeswoman Jill Chanen in a statement. “Safeguarding the security and confidentiality of our client information is and will continue to be our highest priority. Throughout this situation, our professionals continued to provide the level of service excellence our clients expect.”
Foley & Lardner, which earlier this year absorbed Texas-based Gardere Wynne Sewell, did not comment on the nature of the event or provide more details about how it was resolved.
Austin Berglas, who heads the global legal services division at cybersecurity firm BlueVoyant, said the statement seemed to describe what would happen in the event of a ransomware attack or a so-called “cryptojacking” attack. Neither are necessarily designed to steal client data.
Cryptojacking is a relatively new phenomenon. It is a kind of malware that uses a company’s computing network power to run the heavy-duty computing programs that produce (or "mine") new virtual currencies such as Bitcoin. A survey by the network security firm McAfee Labs said that cryptojacking attacks were up 629 percent in the first quarter of the year. McAfee Labs said it recorded nearly 3 million instances of “coin mining” malware in the first quarter of the year, compared to less than 500,000 just a quarter earlier.
“We’ve seen cases where we find ransomware in Fort Knox, essentially: There is gold bullion there and the bad guys didn’t realize it because that’s not what they’re looking for,” Berglas said. “It depends what the adversary is looking for. If they are only interested in getting their crypto-mining executors on as many servers as possible, then a company has essentially dodged a bullet. They’re dealing with a bad guy who does not want that information; they’re just looking for processing power.”
Still, Berglas said the vulnerabilities hackers exploit to install ransomware or crypto-mining software can also be used to steal client data. And sometimes, hackers sell the vulnerabilities they find into corporate networks.
“The key here is no matter what if you are seeing unauthorized access, no matter what they did when they got in, you have a problem you need to fix,” Berglas said. “Because that vulnerability can be used by multiple actors in a lot of ways.”