Breach Disclosure: Rome Lawyers

On May 07 2019, an article published by Repubblica revealed a data breach of emails belonging to 30,000 lawyers in Rome. Anonymous Italy claimed responsibility for the breach in a tweet that same day. Although no passwords were revealed in the breach, sensitive emails and around 42,000 unique e-mail addresses were leaked to the public.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media.

Details

The tweet itself tagged the mayor of Rome, Virginia Raggi. The tweet also contained a link to a blog published by the group, where they outlined the attack as well as provided links to the data troves. The attackers posted screenshots of an administrator and webmail service with direct links to the respective pages, so it looks like they accessed the emails directly. The breach appears to be a retaliation for the arrest of two Anonymous-IT members, Aken and Otherwise, who were arrested years prior.