<b><i>Online Extra:</b></i> Dozens of Big Firms Targeted by Hacker Seeking M&A Info

Our ALM sibling Am Law Daily reached out to several of the firms listed by Flashpoint, all of whom either declined to comment or did not answer requests to do so.

A spokeswoman for Seattle-based Flashpoint said that all the information 'has been turned over to authorities, and they're handling the investigation at this time.'

Tom Ricketts, a senior vice president and executive director at Aon Risk Solutions, a unit of insurance brokerage giant Aon plc,'which has helped more than 60 law firms buy cyberinsurance'within the last two years, said this type of incident is not uncommon.

'More firms absolutely must take this incredibly seriously,' said Ricketts, who was not involved in the attempted attack by the so-called Oleras. 'This is a major threat.'

Ricketts said that hackers will typically pose as someone they're not and send e-mails to firm employees and partners that are meant to trick the recipient into handing over their login credentials. The hackers can then peruse their victim's e-mails for information about pending business transactions that a firm's clients are involved in.

Ricketts said these scams, known as phishing attacks, have become increasingly sophisticated. Hackers no longer need to send out thousands of spam e-mails in the hope that one or two careless people will click on a nefarious link. Ricketts said he was involved in an incident recently in which the hacker sent 70 e-mails and got four hits in response.

The security firm FireEye Inc. published a report detailing the methods used by one group, calling itself 'Fin4,' which uses phishing attacks to obtain M&A information. The group's fake e-mails are written in perfect English, use investing terminology and often 'play up shareholder and public disclosure concerns,”the report said.

Of the more than 100 companies targeted by this group, 20% were law firms, according to Milpitas, CA-based FireEye. In some instances, the hackers were able to inject themselves into email threads between company employees.

On March 3, the FBI released a notification about the threat posed by the cybercriminal who was trying to hire other hackers to help gain access to law firms,'Bloomberg Big Law Business reported at the time. The notification advised firms to educate personnel about the threat of cyberattacks and to carefully scrutinize all e-mails, the report said.'

Knowledge of the tools used by hackers often isn't enough. Last year Russian hackers gained access to sensitive U.S. Department of Defense servers through phishing attacks that duped security professionals into clicking on e-mails containing malicious code,'according to a report by CNET, which noted that hackers also found their way into the personal e-mail account of John Brennan, the director of the CIA.

Nell Gluckman writes for The Am Law Daily, an ALM sibling of e-Commerce Law & Strategy. He can be reached at [email protected]. Follow him on Twitter @NellGluckman.

'

'