Magic circle firm Allen & Overy has refused to comment on whether it paid a ransom to cyber-criminals to have it removed from a hackers’ site.
The firm’s system was compromised earlier this month and ransomware group LockBit claimed responsibility, posting that it would publish stolen data on 29 November.
The A&O listing was removed ahead of that deadline, prompting questions about whether the firm had paid any money to ensure the data was not released. There has also been speculation that the listing may have been removed while negotiations were ongoing.
Asked whether any sum had been paid, the firm declined to comment, adding: ‘What we can confirm is that we are working closely with forensic and other specialists to do everything we can to minimise impact to clients arising from this illegal cyber intrusion.’
A&O said in the aftermath of the cyber-attack that a ‘small number’ of storage servers had been targeted, but that core systems including email and document management were not affected.
‘We appreciate that this is an important matter for our clients, and we take this very seriously,’ said the firm at the time. ‘Keeping our clients’ data safe, secure, and confidential is an absolute priority.’
Ransomware criminals usually encrypt or steal data from an organisation and then offer to decrypt or return that data in exchange for a fee.
The UK and Singapore governments agreed earlier this year not to use central government funds to pay ransoms to cyber criminals.
Payment of ransoms is not illegal per se, but it is not encouraged or condoned by the UK government. Earlier this year it warned that ransom payments could amount to a criminal offence if they involved breaches of financial sanctions.
