Photo Credit: Setyaki Irham
A large media and entertainment law firm representing celebrities and high-profile musicians is now the victim of a massive cyberattack.
Grubman Shire Meiselas & Sacks had nearly 1 TB of data stolen from its servers, according to a data security researcher. The breach included 756 GB of data – including contracts, nondisclosure agreements, phone numbers, email addresses, and “personal correspondence.”
The law firm represents several entertainers in the music industry. Those affected by the theft may include Lady Gaga, Madonna, Nicki Minaj, Bruce Springsteen, Ella Mai, Christina Aguilera, Mary J. Blige, Mariah Carey, Cam Newton, Jessica Simpson, Bette Midler, Priyanka Chopra, and Idina Menzel, according to information now emerging.
Representatives from the law firm have not responded to news of the attack. As of this writing, the law firm’s official website is completely offline, showing only a logo. Hackers carried out a ransomware attack against the law firm resulting in the data breach. In this type of attack, hackers will extort their victims by threatening to release the stolen data unless paid.
Variety reports that it is unable to verify the authenticity of the allegedly stolen documents. Data security researchers say the hackers posted evidence of the hack on a dark web forum. It’s unclear how much the hacker group may have demanded from the law firm in exchange for not revealing the data breach.
At least one document from the law firm data breach is an excerpt from Madonna’s 2019-20 “Madame X” contract with Live Nation.
Data security researchers say the information released so far is just the tip of the iceberg. “It’s the equivalent of a kidnapper sending a pinky finger,” researchers told Variety. The threat seems simple: if the criminals don’t get their payment in Bitcoin or other cryptocurrencies, they will leak all the data they stole in the breach.
Researchers say they believe the hacking group “REvil” targeted the law firm. This group previously hacked other organizations like Travelex and Brooks International. Travelex ended up paying a $2.3 million bitcoin ransom to the hackers.