A cyber attack has impacted Langley Twigg Law, a law firm based in Napier, compromising both internal firm data and client documents. The incident, which occurred on January 11, is currently under investigation with the assistance of digital forensics and cyber specialists.
Details of the Breach
According to a statement released on January 26, the investigation confirmed a “malicious third-party” launched a virus onto the firm’s IT network. The firm stated its cyber security software did not protect against the attack. A portion of data was extracted from the firm’s file server, containing internal operational information and some client documents.
Langley Twigg Law is working to determine the full extent of the data breach and will subsequently notify affected clients. The firm has also contacted both the Office of the Privacy Commissioner and the police, who are now investigating the incident.
Potential Consequences and Next Steps
The firm has expressed its apologies for the breach and is focused on identifying individuals whose personal information may have been compromised. Affected parties are expected to receive appropriate notifications. It is possible that the investigation could reveal a wider range of compromised data than initially suspected.
Langley Twigg Law was in the process of transitioning to a cloud-based document management system at the time of the attack. The firm believes completing this transition will reduce the risk of future incidents. Clients have been advised to monitor their bank and credit card transactions closely and remain vigilant for suspicious communications.
Frequently Asked Questions
When did the cyber attack occur?
The cyber attack occurred on January 11.
What type of data was compromised?
The compromised data includes both internal information relating to Langley Twigg’s operations and some client documents.
What is the Office of the Privacy Commissioner doing?
The Office of the Privacy Commissioner will work with the law firm during the investigation, ensuring they are aware of their legal obligations regarding the privacy breach.
How can organizations best protect themselves and their clients from similar attacks?
