A well-known law firm in New York has been attacked by a group of hackers using the REvil ransomware. The hacker group demanded a ransom of 42 million USD, or else it would publish data on the company's list of famous customers, including President Donald Trump.

A group of hackers exploiting REvil ransomware called Sodinokibi, has successfully carried out many other famous attacks. Most recently, the group targeted the New York-based law firm Grubman Shire Meiselas & Sacks. This is the company that holds a lot of information and activities of many world famous stars such as Madonna, Lady Gaga, Lil Nas X, The Weeknd, Robert De Niro, Drake…

In early May, the Sodinokibi group announced a successful attack on this law firm. Then, on May 11, Grubman Shire Meiselas and Sacks confirmed to entertainment news site Variety that the company had been attacked by the REvil ransomware. At the time, Sodinokibi demanded $21 million in ransom to decrypt the company's data.

 A source told Page Six that the Grubman company refused to negotiate. Grubman's point is that if the company pays, hackers could release confidential company data or customer information. Just a day later, the REvil hacker group sent a new message with the content of increasing the ransom to 42 million USD. In addition, the group also threatened to release data related to US President Donald Trump.

The hacker group posted on its dark web: There's an election race going on and we've found a lot of 'bad' stuff right now. Mr. Trump, if you still want to keep the presidency, push them (law firms), otherwise forget this ambition forever. As for the voters, we can tell you that after the announcement, you certainly won't want to see him as president. The hacker group gave a deadline of one week.

However, the problem is that Mr. Donald Trump has never been a client of Grubman Shire Meiselas and Sacks, whether in the real estate business or when he took office. According to Forbes, the US Federal Bureau of Investigation (FBI) is also currently looking into the case.

Terence Jackson, Chief Information Security Officer (CISO) of security firm Thycotic, said that whether or not the hacker group was in possession of data related to President Trump, the attack put the law firm in an extremely difficult situation.

The data has been leaked and there is no guarantee that if they pay the ransom in full, the hackers will erase the stolen data… Reputation damage has been enormous. I'm sure the company is also aware of the potential legal issues they're facing, Jackson said.

Previous Attacks

In the past few months, the Sodinokibi group has carried out many attacks and demanded a large amount of ransom from the victims.

In April, The Wall Street Journal reported that Travelex, a London-based foreign exchange exchange that does business in 26 countries, including the United States, paid the Sodinokibi group 2.3 million USD to regain access to his data after an attack occurred on New Year's Eve.