Yet another Australian company has become a victim of a ransomware gang, with property valuers Herron Todd White being the latest target
On April 27, the BlackSuit ransomware gang announced their attack on Herron Todd White, an Australian property valuation company, by posting details of the data they exfiltrated on their darknet leak site.
Unlike more verbose ransomware groups, BlackSuit provided limited information. They shared some details from Herron Todd White’s own website, noting the company’s $100 million revenue, and listed the types of data they claimed to have obtained.
“Data 279g – just paperwork, no trash,” said a spokesperson for the gang. They also claimed to have “20g sql_DB – customer and transaction databases.”
To prove the hack, BlackSuit compiled “a list of documents of great value” in a 3.3-gigabyte .ZIP archive. However, as of now, the file-sharing site hosting this archive has reached its download limit and is returning an error.
BlackSuit has not disclosed any ransom demand or deadline. Historically, their ransom demands have been reported to be under US$1 million.
Herron Todd White operates offices across Australia, boasting coverage for “95 percent of Australia’s population” through their network.
The attack has caused significant concern within the company. Some former employees spoke to the Australian Financial Review (AFR) about the incident. One ex-employee mentioned, “I heard it was through one of their systems that’s redundant,” adding that former staff members were discussing the situation extensively.
A spokesperson for Herron Todd White told the AFR that the company is working “diligently and collegially” with its clients to resolve the issue.
REB’s sister site, Cyber Daily, has reached out to Herron Todd White’s PR firm for further comments on BlackSuit’s claims and is awaiting a response.
BlackSuit has seen notable growth since its emergence in May 2023. Initially thought to be composed of members from the Royal and Conti ransomware gangs, BlackSuit executed only a few attacks each month towards the end of last year. However, the group claimed nine victims last month, and in April 2024 alone, they have already targeted 21 victims, including high-profile companies like US pharmaceutical firm Octapharma Plasma and Australian pie maker Vili’s in March.
