Hacker Claims to Have Stolen Files Belonging to Prominent Law Firm Jones Day

A hacker claims to have stolen files belonging to the global law firm Jones Day and posted many of them on the dark web.

Jones Day has many prominent clients, including former President Donald Trump and major corporations.

Jones Day, in a statement, disputed that its network has been breached. The statement said that a file-sharing company that it has used was recently compromised and had information taken. Jones Day said it continues to investigate the breach and will continue to be in discussion with affected clients and appropriate authorities.

The posting by a person who self-identified as the hacker, which goes by the name Clop, includes a few individual documents that are easily reviewed by the public, including by The Wall Street Journal. One memo is to a judge and is marked “confidential mediation brief,” another is a cover letter for enclosed “confidential documents.” The Journal couldn’t immediately confirm their authenticity.

The Journal was able to see the existence of many more files—mammoth in size—also purported to belong to Jones Day, posted by the hacker on the so-called dark web. Hackers typically post such stolen information after the hacked entity fails to pay a ransom. The Journal was able to contact the hacker using an email on its blog.

“We have over 100 gigabytes of data,” the hacker wrote in response to an email from the Journal.

The hacker, in the Journal’s correspondence, said it first reached out to Jones Day management on Feb. 3 and informed the firm that its network had been hacked and that data had been stolen. As of Tuesday, the hacker said Jones Day management hasn’t responded but that it believes the law firm received its letters about the attack. The hacker said ransom negotiations haven't begun.

Jones Day, in its statement, said it hasn’t been the subject of a ransomware attack. Rather, Jones Day said, it has been informed that a company the law firm used to transfer large files electronically, Accellion, “was recently compromised and information taken.” Jones Day said that Accellion is used by many law firms, companies and organizations.

Accellion Inc. announced on Feb. 1 that its Accellion FTA, a platform for transferring files that it says is near its end of life, was the target of a sophisticated cyberattack. The company said that all FTA customers were promptly notified of the attack on Dec. 23.

However, the hacker told the Journal that it hacked Jones Day’s server directly and that it wasn’t involved in the Accellion hack.

An Accellion spokesman said the company doesn’t comment on individual customers but said it is working with all affected FTA clients to understand and mitigate any impact of this incident.

The Journal was able to review some of the information in Clop’s large files. They include what appear to be Accellion configuration files and logs with references to Jones Day email and web addresses.

Other data in Clop’s tranche appear unrelated to the law firm, however, including medical files from a California hospital victimized by a ransomware attack in 2016, according to the Journal’s review.

The law firm Goodwin Procter LP was also hit by the Accellion breach, a person familiar with the matter said. Goodwin’s managing partner, Mark Bettencourt, told employees Feb. 2 in an email that it had informed all of the firm’s clients about a security issue impacting a vendor used for file transfers, according to a copy of the memo reviewed by the Journal. The message from Mr. Bettencourt, which didn’t name Accellion, said the issue appeared to have impacted a “small percentage of our clients” and that the firm was investigating further.

Law firms’ computer files often contain confidential information, including the size and nature of settlements, negotiations about pending deals, and legal strategy that would normally be shielded from the public by attorney-client privilege.

The publication of Jones Day’s files was reported by the cybersecurity blog, DataBreaches.net, this past weekend.

Companies hit by hackers and asked for ransom to release their files respond in different ways. Many reach out to law enforcement or the Federal Bureau of Investigation for help. Some companies start to negotiate with the hackers and try to keep the matter quiet; others notify their clients or other affected potential victims to try to prepare them for possible confidential matters becoming public, an approach many cybersecurity experts recommend.

With more than 2,500 lawyers around the world, Jones Day had deep ties to the Trump administration. More than a dozen of its lawyers worked in the Trump White House, including Don McGahn, who served as White House counsel and oversaw its judicial selection process before returning to Jones Day in 2019.

Founded in Cleveland, the firm now has lawyers spread across four continents and global name recognition. Within the legal industry, Jones Day is known as an autocratic firm where partners have little transparency into day-to-day operations. Its “black box” compensation system, for instance, means partners don’t know how much their peers are getting paid, a rarity at large law firms.

Law firms have long been considered an attractive target for hackers because firm files contain information on sensitive deals and legal matters that firms have a strong incentive to keep confidential. Information on yet-to-be-announced deals can also be used for insider trading. In 2016, federal investigators explored whether a hack of large law firms including Cravath, Swaine & Moore LLP had been used by insider traders.

“You have a high-value target that is perhaps a little bit behind the times with technology and more conservative and more loath to make significant security investments,” said Dan Nelson, the co-founder of a cybersecurity consulting firm that advises law firms. “You add all that together, and you have a problem.”

Law-firm consultants say data breaches at law firms are common but that most don’t become public. International law firm DLA Piper received widespread attention in 2017 for a cyberattack that crippled the firm’s systems.

Partly driven by demands from their financial institution clients, law firms have increased security measures and become more sophisticated at preventing attacks in recent years. At the same time, many large law firms, including Jones Day, have developed cybersecurity and data protection practices to advise their clients on how to prevent and respond to data breaches.

—Kevin Poulsen and Jacob Gershman contributed to this article.

Photo: The law firm of Jones Day in Washington, D.C. - ANDREW KELLY/REUTERS

Link: Hacker Claims to Have Stolen Files Belonging to Prominent Law Firm Jones Day - WSJ