Recently, we received some client data to process for review. There were loose files and a mailbox provided to us. Our protocol is to ingest the data into our processing software called LAW PreDiscovery. This tool extracts metadata and embedded files within files so that each individual file can be reviewed and categorized/coded accordingly.
I got a call on the way home one evening from one of my lit support staff saying that our staging area folders were all renamed and became hidden. A quick Google search of the problem indicated a virus/worm had infiltrated our work environment. So, we reported the issue to our Network Administrator and our Information Security Director.
Our Information Security Director confirmed it was virus/worm and part of the infiltration was that any shared drive of where the malware was found, that drive was also affected.
Sure enough we saw other shared drives affected and it was off to the races to get ahead of the infiltration. It took several days to scan our affected network before our IT folks got a handle on things. Luckily, we didn't lose any data, but had to manually rename all of our top-level folders from the random numerical name the virus gave them back to the original folder names.
We are in the planning stages of isolating our litigation support network environment from the main firm network. Additionally, if time permits, we will be scanning the client data received for malware before processing. I say "if time permits" because we have to balance the urgency of reviewing client data with that of the risk of being infected by malware. It was a good run -- over 15 years of processing data without an incident like this.
Not financial, investment or legal advice
