Williams & Connolly, a leading U.S. law firm with influential political clients, has suffered a cyber breach believed to be carried out by hackers linked to China.
The law firm informed clients that a limited number of attorney email accounts were accessed through a sophisticated zero-day vulnerability, enabling stealthy intrusion. Despite this, Williams & Connolly said there is no evidence that sensitive client data was extracted from other parts of its systems.
The Federal Bureau of Investigation’s Washington office is investigating this incident, which appears connected to a wider campaign targeting several U.S. law and tech firms to gather intelligence for China’s rivalry with the U.S. The hackers seem to focus on espionage rather than ransom or public exposure of stolen data.
Williams & Connolly, known for representing high-profile figures including Bill and Hillary Clinton, engaged cybersecurity experts to manage the threat and has blocked further unauthorised access. Experts warn that law firms remain prime targets for state-backed actors because of their access to non-public information related to intellectual property, international trade, sanctions, and public policy.
China consistently denies claims of state-sponsored hacking, accusing the U.S. of hypocrisy over cyber operations. As the FBI and cybersecurity firms continue to probe the breaches, this episode shows the mounting challenge for the U.S. in defending critical legal and commercial sectors against advanced cyber threats.
“Law firms are prime targets for nation-state threat actors because of the complex, high-stakes issues they handle. Intellectual property, emerging technologies, international trade, sanctions, public policy, to name a few. In short, they hold a wealth of sensitive, non-public information that can offer significant strategic advantage,” said Sean Koessel, co-founder of cybersecurity firm Volexity.