Law firm Shook Lin & Bok hit by ransomware attack

SINGAPORE: Law firm Shook Lin & Bok was hit by a ransomware attack in April, it confirmed on Thursday (May 2). 

The incident was discovered on Apr 9 and the law firm said it immediately engaged a cyber security team. Its systems were contained as of 2am on Apr 10, it said in a statement to CNA. 

There is no evidence so far that the firm’s core document management systems, which contain client data, were affected, the statement read.

The firm continues to operate as per usual. It is also working closely with cyber security teams and other specialists to minimise the impact to its clients and stakeholders arising from the “illegal cyber intrusion”. 

According to an article on SuspectFile, which calls itself an independent website focusing on the ransomware phenomenon, Shook Lin & Bok paid a ransom of US$1.4 million in Bitcoin to the Akira ransomware group. 

The group initially demanded a ransom of US$2 million, which was negotiated down after a week, the article said. 

The Cyber Security Agency of Singapore (CSA) said it was aware of the incident and has offered assistance to the law firm.

“The government strongly discourages victims from paying ransom, as there is no guarantee that locked data will be decrypted or that stolen data will not be used for malicious purposes once ransom has been paid,” its spokesperson said in a statement to CNA.

“Threat actors may also see such organisations as soft targets who are willing to pay up, and strike again. Paying also encourages the threat actors to continue their criminal activities and target more victims.”

Shook Lin & Bok did not respond to questions about whether it paid the ransom and how much it paid. CNA understands the firm has made a police report.

“All steps taken thus far in response to the illegal cyber intrusion and steps that we intend to take in future are and will be done with the best interest of our clients and stakeholders at the forefront of our consideration,” it said in its statement.