Cyber Incident Victim: Law In Order
Date:
Nov 2020
Location:
Australia
Summary
An Australian legal services provider experienced a ransomware attack disrupting its operations, with the incident attributed to Netwalker malware. The company, which offers document and digital solutions to law firms, confirmed the compromise and temporarily restored its website using Cloudflare's protective infrastructure. The attack occurred over a weekend, forcing the organization to address system impacts while attempting to maintain service continuity for its clients in the legal sector.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
Law In Order, an Australian provider of document and digital services to legal firms, experienced a ransomware attack during the weekend of November 21, 2020. The intrusion involved Netwalker malware, a known ransomware variant. The company publicly acknowledged the incident through a statement posted on its website, though the site itself became temporarily inaccessible following the attack. By the evening of November 24, Law In Order had restored its website functionality by leveraging Cloudflare’s security infrastructure, indicating efforts to mitigate immediate disruptions to its online presence. The attack timeline suggests operational systems were compromised over a short period, though the exact duration of system unavailability prior to restoration remains unspecified.
The incident disrupted Law In Order’s digital services, which are critical to its client base of law firms requiring document management and litigation support. No specific details were disclosed regarding data exfiltration, encryption scope, or ransom demands. The company’s primary confirmed response action involved technical remediation to regain control of its public-facing website, employing Cloudflare as a protective measure against further disruptions. The reliance on Cloudflare implies concerns about ongoing availability risks or potential follow-on attacks. Law In Order did not release information about internal containment procedures, forensic investigations, or coordination with law enforcement at the time of its initial statement. Service impacts beyond website accessibility were not quantified, leaving the operational consequences for legal sector clients unclear based on available disclosures.