Loading story…
A breach at UK law firm ACS:Law exposed confidential data on thousands of broadband subscribers accused of illegal file-sharing, including people allegedly linked to adult-film downloads. Reports said the leak followed disruption tied to Operation Payback, after which a backup file was mistakenly left publicly accessible and then widely redistributed online. The exposed material included roughly 1,000 internal emails, names, addresses, IP addresses, compensation demands, case notes, and in some cases payment details and correspondence from accused individuals; affected customers were reported across Sky, PlusNet, and other ISPs, with totals rising from more than 5,000 to well over 8,000 records as additional files surfaced.
The incident triggered scrutiny from the UK Information Commissioner's Office and the Solicitors Regulation Authority, with regulators examining whether ACS:Law had failed to protect sensitive personal data under the Data Protection Act and whether fines of up to £500,000 were warranted. ISPs including Sky said they were deeply concerned and suspended cooperation until adequate safeguards were shown, while critics said the leak underscored longstanding problems with ACS:Law's mass-enforcement tactics and reliance on IP-address evidence. Months later, solicitor Andrew Crossley told the High Court he had stopped pursuing alleged file-sharers, citing criminal attacks, hacked emails, and threats against him and the firm.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
During patent court proceedings in London, ACS:Law solicitor Andrew Crossley said he had stopped pursuing alleged illegal file-sharers in 26 MediaCAT cases. He cited criminal attacks, hacked emails, and death and bomb threats.
Sky said it was very concerned by the leak and suspended cooperation with ACS:Law until the firm could demonstrate adequate security measures. ACS:Law principal Andrew Crossley said the firm had notified police, the ICO, and the Solicitors Regulation Authority.
Additional leaked files exposed data on thousands more alleged file-sharers, including over 8,000 Sky subscribers and about 400 PlusNet users, with some records reportedly containing credit card details and correspondence from accused individuals. The stolen data was reportedly uploaded to The Pirate Bay for wider distribution.
The UK Information Commissioner's Office said it would examine ACS:Law's security controls after the breach, including encryption, firewalling, staff training, and why sensitive information was publicly accessible. Reports said the firm could face a fine of up to £500,000 under the Data Protection Act.
Attackers obtained and distributed ACS:Law data after the exposed backup file was discovered, leaking around 1,000 confidential emails and personal details tied to thousands of alleged file-sharers. The exposed material included names, addresses, IP addresses, allegations involving pornographic downloads, and other sensitive case information.
ACS:Law's website was hit by DDoS activity linked to 4chan participants in Operation Payback. During efforts to restore the site, a backup file containing website data was reportedly exposed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
web.archive.org
Open sourcebbc.co.uk
Open sourceweb.archive.org
Open sourcetheregister.co.uk
Open sourceweb.archive.org
Open sourcetheregister.co.uk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
HWL Ebsworth, a prominent Australian law firm, suffered a ransomware attack by the ALPHV (BlackCat) group, resulting in the exfiltration of sensitive client data. In response, the firm obtained a court injunction intended to prevent the hackers from publishing or sharing the stolen data, as well as to restrict its dissemination by third parties, including journalists and security researchers. Despite being served with the injunction, the threat actors openly mocked the legal action and proceeded to release a substantial amount of the compromised data online, demonstrating the limited practical effect of such legal measures on criminal actors. The injunction, however, provided a legal basis for HWL Ebsworth to request that online platforms refrain from hosting or distributing the stolen data, potentially limiting its spread among legitimate entities. This case highlights the challenges organizations face in controlling the aftermath of a data breach, especially when dealing with transnational cybercriminals who are unlikely to respect legal orders. The incident also raises concerns about the balance between protecting sensitive information and the ability of journalists and security professionals to analyze and report on breaches for the public good. Meanwhile, law enforcement agencies continue to target cybercrime infrastructure, as evidenced by the recent seizure of BreachForums, a notorious platform for trading stolen data. The seizure was carried out by a coalition of U.S. and French authorities, including the Department of Justice, FBI, BL2C, and JUNALCO, and resulted in the takedown of both the clear net and onion versions of the forum. At the time of the seizure, the group ScatteredLAPSUS$Hunters was threatening to leak data from 39 Salesforce customers unless a ransom was paid, with high-profile companies such as Qantas, Air France & KLM, Disney/Hulu, UPS, FedEx, Home Depot, Gucci, and Toyota Motors among the potential victims. The law enforcement action included changing the name servers of the forum's domains to those controlled by the FBI, effectively cutting off access to the site and its backup domains. Despite these efforts, some elements of the criminal infrastructure, such as alternative onion sites, remained operational, illustrating the resilience and adaptability of cybercriminal networks. The seizure of BreachForums was met with mixed reactions in underground communities, with some users expressing defeat and others urging continued resistance. These events underscore the ongoing cat-and-mouse dynamic between cybercriminals and law enforcement, as well as the limitations of both legal and technical interventions in fully mitigating the risks and impacts of major data breaches. Organizations targeted by ransomware and data theft must navigate a complex landscape of legal, technical, and reputational challenges in their response efforts. The effectiveness of court injunctions and law enforcement takedowns is often constrained by the global and decentralized nature of cybercrime. Both incidents demonstrate the need for comprehensive, multi-layered strategies to address the evolving threat landscape and protect sensitive data from exposure and misuse.
Jun 29, 2026
A UK local authority disclosed personal data during its complaints-handling process after forwarding complaints to a councillor with **all complainants’ identifying details** included, despite some complainants opting to withhold their names. The information reportedly exposed included sensitive contact details (e.g., home addresses, email addresses, phone numbers) that would not normally be shared with the subject of a complaint, raising a **data protection breach** and governance concerns around how complaint records are processed and redacted. Separately, the UK **Information Commissioner’s Office (ICO)** won a court battle in its long-running attempt to uphold a **£500,000 fine** against **DSG Retail** (owner of *Currys PC World* and *Dixons Travel*) tied to a major 2017 breach in which malware was installed on **5,390 point-of-sale tills** and remained undetected for **nine months**. The incident involved theft of **5.6 million payment card numbers and expiry dates** (without cardholder names) and personal data relating to roughly **14 million individuals**; a central legal dispute is whether the payment card data alone constitutes **personal data** under the applicable pre-GDPR regime. A third item argues for using **tax incentives** (modeled on green-energy policy) to drive “security by design” and improve cybersecurity outcomes, but it is a policy opinion piece rather than reporting on a specific incident or enforcement action.
Jun 29, 2026
The U.K. Information Commissioner’s Office fined South Staffordshire Water’s parent company **£963,900** after finding that the **Cl0p** ransomware group gained access through a phishing email in September 2020 and remained inside the network for about 20 months. The intrusion was discovered only in July 2022 after IT performance issues prompted an internal investigation, which later uncovered a ransom note and the publication of roughly **4.1 TB** of stolen data on the dark web affecting **633,887** customers and employees. The ICO said the breach was enabled by multiple basic security failures, including weak least-privilege controls, limited monitoring, poor vulnerability management, unsupported systems such as **Windows Server 2003**, and unpatched domain controllers vulnerable to **`ZeroLogon`**. Investigators found the attackers moved laterally using a domain administrator account and accessed highly sensitive personal and financial data, including National Insurance numbers and Priority Services Register information that could reveal disabilities; while Cl0p made claims about water supply manipulation, the regulator said its notice did not identify any compromise of operational or water treatment systems.
Jun 29, 2026