Zaha Hadid Architects

Summary

Hackers stole sensitive data from Zaha Hadid Architects, deployed ransomware to encrypt systems, and threatened to leak stolen files on the dark web unless a ransom was paid. The attackers, identifying as Light, claimed possession of payroll records, bank documents, employee contracts, email dumps, and critical security credentials like SSL certificates and Active Directory details. They provided evidence of the breach to media outlets and set an imminent deadline for data publication. The firm acknowledged the incident but refused negotiations, opting to collaborate with forensic experts instead. This attack reflects a growing trend where ransomware groups exfiltrate and weaponize data to pressure high-profile victims into paying.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In late April 2020, Zaha Hadid Architects experienced a significant cybersecurity incident when hackers operating under the name "Light" infiltrated the firm's network. The attackers exfiltrated sensitive data before encrypting systems with ransomware. On April 28, 2020, the group contacted ZDNet to announce their intention to leak stolen files on the dark web unless the firm paid an unspecified ransom demand. The hackers provided journalists with evidence of compromised data, including payroll records, bank documents, employee contracts, life insurance details, and Active Directory credentials. They also possessed email inbox dumps and SSL certificates, indicating broad network access. The group set an imminent deadline, threatening to publish the data later that same day if their demands remained unmet. This ransomware attack followed an emerging pattern where cybercriminals combine data encryption with extortion through threatened leaks, escalating pressure on victims beyond operational disruption to reputational risk.

Zaha Hadid Architects confirmed the security breach but publicly refused to negotiate with the attackers. The firm engaged a digital forensics company to investigate the incident and manage containment efforts. By declining payment, the architecture practice risked exposure of its stolen employee and financial records through the dark web portal established by the Light group. The attackers' possession of Active Directory credentials suggested potential compromise of network authentication systems, while email dumps indicated unauthorized access to corporate communications. The Light group appeared to be a newly emerging ransomware operation, employing double-extortion tactics by pairing data theft with encryption. The incident exposed vulnerabilities in the firm's digital infrastructure, though specific technical details about initial access vectors and detection timelines were not publicly disclosed. Financial and operational impacts remained unquantified in available reports, but the theft of sensitive employee and banking information created significant privacy concerns for affected individuals.

Sources

Sources available to members: 1 source.