Langley Twigg Law

Summary

Langley Twigg Law detected unauthorized network activity on its systems, promptly disconnected the network from the internet and engaged its IT support provider to contain the breach. The firm subsequently rebuilt its infrastructure from backups after additional security hardening and enlisted digital forensics experts who confirmed that data had been accessed and copied from its file server. Compromised material included internal operational records, client documents, financial and HR information, employee compensation records and staff passport details, some of which were later posted by the Anubis ransomware group on its leak site. The firm notified the Office of the Privacy Commissioner and New Zealand Police, and stated that affected clients would be contacted once the review of the exfiltrated data is complete.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On 11 January 2026, security monitoring tools at Langley Twigg Law detected unauthorized network activity on the firm’s systems, prompting an immediate response from its IT support provider. The firm’s IT team, working with the provider, initiated containment measures by taking the affected systems offline and disconnecting the network from the internet. After isolating the environment, Langley Twigg Law began rebuilding its systems from backups while applying additional security hardening steps. The firm described the intrusion as a novel attack that had bypassed its existing cyber controls. Digital forensics and cyber incident response specialists were engaged to investigate the breach, and they confirmed that data had been accessed and copied from the firm’s file server. The firm disclosed the incident publicly on 26 January 2026, noting that the disclosure came one day after the ransomware group Anubis claimed responsibility on its darknet leak site. In its statement, Langley Twigg Law characterised the compromise as involving only a small proportion of its data and labelled the event a malicious third‑party attack. The firm emphasized that it had taken steps to restore operations and improve its defenses following the incident.

Langley Twigg Law reported that the compromised information included internal operational data as well as some client documents, although the exact scope remained under review at the time of disclosure. The firm’s investigation, assisted by the forensics team, was focused on determining precisely which files had been accessed and copied from the file server. Among the data that the ransomware group claimed to have exfiltrated were financial reports, employee compensation records and associated documentation, staff passport details and other personal records. The firm notified the Office of the Privacy Commissioner and New Zealand Police to meet its privacy and regulatory obligations following the breach. Langley Twigg Law stated that affected clients would be contacted once the review of the copied information was complete, noting that the process might take some time as the investigation continued. The firm indicated that it would provide further details to clients after confirming the specific data elements that had been exposed. No evidence of data modification or destruction was reported by the firm at the time of its public statement. The firm’s communications stressed that it was working to understand the full impact while maintaining transparency with regulators and affected parties.

On its darknet leak site, the Anubis ransomware group listed Langley Twigg Law as a victim and asserted that it had exfiltrated financial and HR‑related material from the firm. The group’s post described the stolen dataset as comprising financial reports, employee compensation records and associated documentation, together with staff passport details and other personal records. Anubis highlighted the apparent authenticity of the documents, a tactic it uses to increase pressure on victims by demonstrating the sensitivity of the stolen information. The group frequently publishes granular descriptions of stolen data and threatens regulatory fallout for victims as a lever to encourage ransom payment. Unlike some ransomware operators that share only high‑level teasers, Anubis provides detailed inventories of the information it claims to have taken. The firm’s leak post also reflected Anubis’s practice of impersonating journalists and offering “exclusive” access to stolen data as part of its extortion playbook. Anubis’s most recent ANZ victim before Langley Twigg Law was the Queensland medical practice Laidley Family Doctors in December 2025. The group’s communications consistently aim to highlight perceived security failures while seeking to coerce payment through the threat of public disclosure.

Anubis is a relatively new entrant to the ransomware‑as‑a‑service ecosystem, having first been observed in February 2025. Security researchers say the group appears to be Russian‑speaking and operates on a franchise model that supplies ransomware tooling and infrastructure to affiliates. IT experts say Anubis has an optional “wipe mode” feature which permanently erases the contents of the files, suggesting that the threat actor could wipe their victim’s files if the ransom is not paid. The group’s activity has been characterised by a pattern of publishing detailed leak posts and employing psychological pressure tactics to compel victims to negotiate. Anubis’s approach combines technical capabilities with information‑operations strategies to maximise the impact of its attacks. The firm’s experience with Anubis aligns with the group’s broader methodology of targeting organisations that hold sensitive personal and financial data. No indication of payment or negotiation was disclosed by Langley Twigg Law in its public statements regarding the incident. The narrative of the incident concludes with the firm’s ongoing efforts to finalise its review, notify affected parties, and cooperate with regulatory authorities.

Sources

Sources available to members: 1 source.