Slater and Gordon refers outcomes of forensic investigation to Victoria police

Slater and Gordon has today confirmed it has referred outcomes of its forensic investigation into the recent malicious email to Victoria Police.

A series of identical malicious emails were sent in batches to over 900 recipients between 9:41 AM and 9:57 AM on Friday, 21 February. Slater and Gordon rapidly established a Board Incident Response Committee which oversaw a forensic investigation, assisted by external advisors.

Based on the investigation, Slater and Gordon believes that:

There are reasonable grounds to suspect that the email may have been sent by a former employee who was aware of the firm’s security protocols and had previously been authorised to access certain data.
More than 10 emails were sent which appears to have been designed to circumvent IT protocols.
The IT team and certain senior executives appear to have been deliberately excluded from the recipients list.
No client information was compromised in any way.
The data attached to the email appears to have been taken from at least three different internal source documents, which were combined and altered. Those source documents have restricted access within the firm.
There is no evidence to suggest that any current employee, contractor, or external threat actor was involved.
The email was a premeditated and carefully planned attack which Slater and Gordon condemns in the strongest possible terms.

Slater and Gordon continues to believe former Chief People Officer, Mari Ruiz-Matthyssen was not responsible for the email.

In the aftermath of the incident, the firm acted swiftly to contain and mitigate its impact and support those affected. Actions taken include:

Removing the email from all inboxes within 90 minutes and locking down the staff email archive system to prevent further dissemination of the email.
Providing a confidential contact number for staff to confirm whether they were included in the email and, if so, what information was disclosed.
Proactively contacting impacted former staff members.
Offering the firm’s Employee Assistance Program (EAP) to all staff.
Continued communication to keep staff informed and to outline the support available.
Notification to the Office of the Australian Information Commissioner.

Slater and Gordon has an existing and ongoing program to review and strengthen security controls and that work continues.

The firm will not be making further public comment on this matter while it remains under police investigation.

Attributable to Slater and Gordon CEO, Dina Tutungi:

“This matter continues to be taken extremely seriously by Slater and Gordon, and we have referred the outcomes of the forensic investigation to Victoria Police. We will continue to assist the police with their work.”

“While this malicious incident was unwelcome, our priority remains our people and the critical work we do every day to provide access to justice for our clients.”