Ride the Lightning

Law Firm Campbell, Conroy & O’Neil Discloses Data Breach

July 22, 2021

Dark Reading reported on July 19 that Campbell Conroy & O’Neil (Campbell), a law firm representing hundreds of major organizations, confirmed a data privacy incident related to a ransomware attack detected earlier this year.

Campbell’s client list includes prominent companies across industries including automotive, aviation, chemical, construction, energy, hospitality, insurance, medical devices, pharmaceutical, retail, and transportation. Past and current clients include Ford Motor Company, General Motors, Boeing, Johnson & Johnson, Pfizer, Home Depot, and Exxon.

Campbell discovered unusual activity on its network on February 27, 2021, officials confirmed in a release. An investigation revealed its network had been struck with ransomware. Campbell hired third-party forensics investigators to determine the information affected.

The release said in part, “Campbell is providing notice because the investigation thus far determined that certain information relating to individuals was accessed by the unauthorized actor.”

No group has yet claimed responsibility for the attack.

While the law firm cannot confirm if the attacker accessed or viewed any specific data, Campbell has reported the information present in the affected system included certain individuals’ names, birthdates, driver’s license numbers and state identification numbers, financial account data, Social Security numbers, passport numbers, payment card data, medical information, health insurance information, biometric data, and/or online account credentials.

Some illuminating comments by experts about this incident may be found here.

As a story from The Register pointed out, it took nearly five months for the law firm to notify its clients.

Hat tip to Dave Ries and John Simek for making sure I saw multiple reports on this incident.

Sharon D. Nelson, Esq., President, Sensei Enterprises, Inc.
3975 University Drive, Suite 225|Fairfax, VA 22030
Email:  Phone: 703-359-0700
Digital Forensics/Cybersecurity/Information Technology
https://senseient.com
https://twitter.com/sharonnelsonesq
https://www.linkedin.com/in/sharondnelson
https://amazon.com/author/sharonnelson