Law firm Gibson & Co experienced a potentially serious data breach following a ransomware attack.
The firm, which has offices in Newcastle upon Tyne and Hexham specialises in Dispute Resolution, Property and Personal Affairs. It contacted clients to warn them about the privacy violation.
Admitting that a “small amount of data left the firm”, the compromised information included client names and contact details. According to an email from Gibson & Co, “confidential working materials (including any ID documents, any materials you have provided to us, bank statements, account details and all legal advice you have been given) are all on a separate server and this data did not leave the firm.”
However, the firm acknowledged that clients were potentially at risk and warned them to be vigilant of anyone contacting them with unusual requests for payment, or for any account information.
To ensure they do not fall victim to further attacks, anyone affected by the Gibson & Co data breach should be vigilant. In particular, clients should exercise caution if they receive any unusual requests for information from anyone claiming to be from Gibson & Co.
We have seen victims of similar data hacks become the target of cybercriminals, with instances of phishing, fraud, and identity theft. Our data protection experts strongly advise anyone involved in this breach to be vigilant and take necessary precautions.
Gibson & Co. was the subject of a ransomware cyber-attack. According to the company, hackers may have accessed the firm’s servers.
A “small amount of data left the firm”, this is believed to include client names and contact details.
In an email to affected clients, Gibson & Co said:
“I am writing to inform you that unfortunately Gibson & Co. was the subject of a cyber-attack last week. We had robust firewalls and other appropriate and up to date security measures in place, including multiple level passwords and multi factor identification. However, it was a highly sophisticated and determined attack. It appears possible that a small amount of data left the firm. This would have been from an SQL server and have contained client names and contact details. Our confidential working materials (including any ID documents, any materials you have provided to us, bank statements, account details and all legal advice you have been given) are all on a separate server and this data did not leave the firm.
“As a precaution, we are informing you of this event in case anyone purporting to be from this firm contacts you with e.g. an unusual request for payment, or asks you for any account information. You should exercise the usual caution in dealing with any such requests and not provide such information. Do not click on any attachments in an email which appears to be from us (or indeed from anyone) unless it is something you are expecting. If you are in any doubt, please get in touch with your usual contact at Gibson & Co. before taking any action.
“The aim of the attack was to encrypt all our data and to extort a ransom payment for its return. This failed. I should stress therefore that the chances of your contact details having been compromised is low, but we cannot rule it out, hence us contacting you as a precaution. We have reported the breach to the Information Commissioner’s Office and the Solicitors’ Regulation Authority.
“We are sorry for any distress this may have caused. The confidential nature of the work we do for you is something we take very seriously and we have implemented a series of additional security measures to prevent as far as is humanly possible such an attack succeeding again.”
Gibson & Co should be in touch to notify affected individuals.
Anyone who thinks they might be involved should take immediate steps to protect themselves.
KP Law has some of the most skilled data breach lawyers in England and Wales. Here are just some of our success stories.
KP Law is a founding member of the Collective Redress Lawyers Association (CORLA). CORLA aims to improve access to justice for claimants by way of collective redress.
