Does your firm have an email server? If so, see below for urgent security guidance from Microsoft and the Australian Cyber Security Centre.
Microsoft announced earlier this week that it had detected an overseas hacking group exploiting vulnerabilities in its Exchange Server email product.1 Exchange Server is used by many law firms which manage their email from their own server. Microsoft says the hacking does not appear to be widespread yet, but did potentially allow the attackers to get a lot of information from the target systems.
Other reports indicate the problem is more widespread, with a larger number of targets than first thought.
A ‘patch’ – software update to fix the problem – has been released. If your firm has server-based email, you should check with your IT contractor to see if the update is required for your version and whether it has been applied if needed.
Keeping software up to date by automatic patching and regular maintenance by a qualified person is an essential part of good data security. Patches are ordinarily released on a defined schedule, but in some cases are sufficiently urgent that action should be taken earlier.
Action required: Check with your IT support whether the Hafnium Zero Day attack could affect your firm. If so, confirm that the software updates to counter it will be installed in the near future.
Priority: High, but not drop-everything urgent.
More guidance is available from the Australian Cyber Security Centre.
Footnote
1 Microsoft Exchange Server 2013, 2016, 2019. O-365 and Exchange Online not affected.
Share this article