HWL Ebsworth — The Law Firm Holding Everything

HWL Ebsworth is one of Australia's largest commercial law firms. As of early 2023, its client list included the Reserve Bank of Australia, all four major Australian banks, large insurance companies, ASX-listed corporations and dozens of Commonwealth and state government departments. To service these clients, the firm received and held substantial volumes of sensitive financial data: loan documentation, board papers, credit card information, identity documents, internal financial reports, customer files.

The firm operated under standard professional and regulatory obligations to keep client data confidential and secure. Internal policy committed the firm to industry-aligned information security practices, including access control, network segmentation and regular security reviews. There is no public indication the firm operated under a formally certified ISMS.

On 28 April 2023, the ALPHV/BlackCat ransomware group claimed to have exfiltrated data from HWL Ebsworth's network. Court documents later revealed that the firm had received emails from the attackers as early as 26 April that were initially treated as spam. By May, around four terabytes of data was claimed stolen; in June, approximately 1.4 TB was published to the dark web after the firm refused to pay the ransom.

The breach surfaced two structural realities. First, the firm had accumulated client data well beyond active engagements - including documents from matters closed years earlier - because there was no enforced retention or destruction policy aligned with how much sensitive data the business actually generated. Second, network segmentation between matter files for different clients was limited, allowing the attackers to access data from many clients through a single compromised area. Both realities had developed gradually as the firm grew, without corresponding adjustments to controls or audit scope.