A hacker claims to have stolen and posted files from global law firm Jones Day on the dark web; Jones Day says a file-sharing company it used was compromised
Firm disputes network breach, says its file-transfer company was compromised — A hacker claims to have stolen files belonging …
Wall Street Journal
Context & Ripple Effects
Jones Day attributes the reported exposure to a third-party file-sharing provider rather than an intrusion into its own network. Related coverage later identified the incident as part of the Accellion file-transfer software hack, which also reached organizations including New Zealand’s central bank and Washington state unemployment-benefits applicants.
Jones Day must manage a public claim that its files were posted while maintaining that its internal network was not breached.
Accellion’s file-transfer software becomes the immediate security focus because related coverage identifies it as the compromised service affecting Jones Day.
Second-order effects
Organizations that used the same file-transfer software face a shared exposure event, shifting incident-response attention from each customer’s network to the vendor connection.
Law firms and other holders of sensitive records have a clearer reason to scrutinize the security of file-exchange providers, not only their own perimeter controls.
Third-order effects
If attacks on shared transfer and filing systems persist, third-party document platforms will become security choke points whose failures can expose many institutions at once.
The pattern favors more action-level security around document exchange: access, transfer, and vendor integrations become as consequential as protection of the internal network.
The trend: Cybersecurity risk is moving beyond enterprise perimeters toward the shared document-transfer services that connect institutions to clients and counterparties.
In case you were wondering, #DDoSecrets is already working with the data and helping put it in the hands of journalists. https://www.vice.com/...
@davidenrich
David Enrich on x
Oh boy. Hacker claims to have stolen many gigabytes of files belonging to @JonesDay. https://www.wsj.com/...
@rebeccaballhaus
Rebecca Ballhaus on x
A hacker claims to have stolen files belonging to the global law firm Jones Day, which has counted the Trump campaign among its clients, and posted many of them on the dark web. @tawnell & @sara_randazzo https://www.wsj.com/...
@malwarejake
Jake Williams on x
Of course the attackers “had no other choice” but to release the data... https://twitter.com/...
@lorenzofb
Lorenzo Franceschi-Bicchierai on x
NEW: Hackers have leaked files from the Jones Day law firm on a dark web site. The hackers told us that they contacted the law firm after the breach but “they responded with silence and we had to upload the data.” https://www.vice.com/...
@jeffstone500
Jeff Stone on x
some news here: Hackers claim to have stolen and published files from Jones Day, a global law firm that includes Donald Trump as a client. They tell @WSJ they have >100GB of data, though that seems to be unverified. https://www.wsj.com/...
@rstephens
Robert Stephens on x
I asked my longtime CPA where he stores his passwords: “in my head”, he said. My local, rural wireless ISP: “in an Excel file”. This tends to be the default. It would be safer on your iPhone locked with Touch:FaceID https://twitter.com/...
@josephfcox
Joseph Cox on x
New: hackers advertising data from high profile law firm Jones Day, which represented Trump in election challenges. Samples currently available on a Tor hidden service. Hackers tell us they haven't deployed ransomware on this target, only stolen files https://www.vice.com/...
@campuscodi
Catalin Cimpanu on x
@Techmeme This is the Accellion fallout. Four other companies are listed on the Clop site, including Singtel (via @breditor) https://srslyriskybiz.substack.com/ ... https://twitter.com/...