Ride the Lightning

Law Firm Hackers Up Ransom Demand to $42 Million, Claim to Have Dirt on Trump

May 18, 2020

Here I am citing Variety again (strange times indeed), which reported on May 15^th that the cybercriminals who stole a ton of private data from New York entertainment law firm Grubman Shire Meiselas & Sacks have doubled their ransom demand to $42 million.

The hackers hold thousands of the law firm's documents, allegedly including private info on Lady Gaga, Madonna, Nicki Minaj, Bruce Springsteen, Mary J. Blige, Ella Mai, Christina Aguilera, Mariah Carey and many others. They are threatening to publicly release more data if they're not paid within a week.

The law firm, through a rep, said it is not negotiating with the hackers. The FBI is conducting a criminal investigation into the data breach and ransomware demands.

On May 14, the hackers made public 2.4 gigabytes of documents relating to Lady Gaga, including contracts and nondisclosure agreements.

But here's the weird twist. The hackers said in a blog post on the dark web, "The next person we'll be publishing is Donald Trump. There's an election race going on, and we found a ton of dirty laundry on time." They added, "And to you voters, we can let you know that after such a publication, you certainly don't want to see him as president. Well, let's leave out the details. The deadline is one week."

Quite odd, since the law firm has never represented Donald Trump or the Trump Organization in any legal matter. Maybe they are bluffing or maybe they got the data from another source. Who knows?

In a statement provided to Variety through a rep, Grubman Shire Meiselas & Sacks said, "Our elections, our government and our personal information are under escalating attacks by foreign cybercriminals. Law firms are not immune from this malicious activity. Despite our substantial investment in state-of-the-art technology security, foreign cyberterrorists have hacked into our network and are demanding $42 million as ransom. We are working directly with federal law enforcement and continue to work around the clock with the world's leading experts to address this situation."

The statement continued, "The leaking of our clients' documents is a despicable and illegal attack by these foreign cyberterrorists who make their living attempting to extort high-profile U.S. companies, government entities, entertainers, politicians, and others." The law firm said that other organizations and companies including HBO, Goldman Sachs and the Department of Defense have been victims of similar cyberattacks.

According to the hackers' post, they have received payment of $365,000 in connection with the documents stolen from the law firm. The group complained that they didn't get the money they first demanded, "So, the ransom is now $42,000,000. They have that's [sic] the kind of money. And even more." The law firm said it was not true that the law firm had made any payment to the hacking group.

"We have been informed by the experts and the FBI that negotiating with or paying ransom to terrorists is a violation of federal criminal law," Grubman Shire Meiselas & Sacks said in the statement. "Even when enormous ransoms have been paid, the criminals often leak the documents anyway."

The firm confirmed its computer systems were hacked, resulting in the theft of 756 gigabytes of private documents and correspondence. "We are grateful to our clients for their overwhelming support and for recognizing that nobody is safe from cyberterrorism today," the firm said in its statement.

The hack was carried out by a group called "REvil," also known as "Sodinokibi," according to New Zealand-based cybersecurity firm Emsisoft. The REvil group has previously staged ransomware attacks on entities including Travelex, the U.K.-based currency-exchange company, which paid $2.3 million in bitcoin to hackers, according to the Wall Street Journal.

There's a movie waiting to be made from this story – except we don't have the ending yet.

Sharon D. Nelson, Esq., President, Sensei Enterprises, Inc.
3975 University Drive, Suite 225|Fairfax, VA 22030
Email: Phone: 703-359-0700
Digital Forensics/Cybersecurity/Information Technology
https://senseient.com
https://twitter.com/sharonnelsonesq
https://www.linkedin.com/in/sharondnelson
https://amazon.com/author/sharonnelson