South Florida

‘Ransomware incident’ in South Florida blocked some law firms from countless records

Reams of digital legal documents have been held hostage under a ransomware threat to a South Florida software company that manages electronic records for thousands of law firms nationwide, the Miami Herald has learned.

The full impact of the threat against Coral Gables-based TrialWorks was not immediately clear. But on Thursday, a Florida law firm was forced to request more time to meet a filing deadline in a gender-discrimination employment case in federal court because it could not access its electronic documents stored with TrialWorks.

“My request for information has fallen on deaf ears,” attorney Jason Melton, a managing partner with Whittel & Melton in Spring Hill, told the Miami Herald on Friday. “They have kept us in the dark. It has been one of the more frustrating events [at this law firm] in a long time.”

TrialWorks acknowledged it “was recently targeted by a ransomware incident that did not affect our software but did prevent approximately 5 percent of our customers ... from accessing their accounts.”

In a statement, the company said it started an internal investigation and retained independent cybersecurity experts. “We have been working around the clock to restore normal operations for our customers as quickly as possible, and nearly all customers have had access restored within a week.”

Company officials said they have not contacted federal authorities about the ransomware attack but plan to share information from the internal investigation with law enforcement.

On Friday, the FBI declined to comment and the U.S. Attorney’s Office in Miami did not respond to a request for comment.

Earlier this month, TrialWorks began alerting its customers about the security breach and initially indicated it was caused by a Microsoft service outage affecting Outlook desktop and mobile apps, according to court records. But the company’s customer alerts became more ominous over the past two weeks, including one that cited a “ransomware incident.”

During the past decade, TrialWorks and other software management companies have grown dramatically as law firms seek to store voluminous files of electronic documents with a host facility. But as these firms move their digital case files, most of them involving civil litigation and other records, into the cloud, the issue of security has become paramount — especially against ransomware threats. Of late, such threats have gained notoriety for striking municipal governments in Florida and other states across the nation.

Ransomware is a form of malware that hacks an entire data system with encryption that cannot be broken until a sum of money is paid by the target. The perpetrator often demands payment in untraceable bitcoins and threatens to delete files and raise the ransom until the payoff is made.

In mid-October, TrialWorks alerted law firms and attorneys who use the company’s case management service that they could not access their electronically stored documents while the firm was attempting to resolve the security breach problem. The company cited the “ransomware incident” in its correspondence with at least one law firm, but did not elaborate.

“In working with our cybersecurity experts, they have cautioned that we do not provide access to customers until all of the restoration is complete,” TrialWorks wrote to a customer in an Oct. 16 email. “As a result, we will continue to double down to complete all restoration activities as safely and effectively as possible.”

This week, as the problem escalated, TrialWorks informed customers that it was working through “the residual issues” but cautioned that it was “still experiencing high-ticket volume, therefore our response may be delayed.”

TrialWorks, which expanded significantly when it merged with another company, Needles, two years ago, portrays itself as the industry leader of case management software solutions on its website. “For any law practices, insurance and government agency having all your litigation case files and activities tracked and managed in one place is a major advantage to serving your clients,” the company says.

But for Melton’s nine-lawyer law firm, with offices in Spring Hill, Gainesville and Boca Raton, the inability to access its electronic records stored with TrialWorks has slowed down its entire operation.

“I’ve been waiting for specifics from the beginning [of this problem] so we can plan around it,” said Melton, whose firm specializes in personal injury, employment and criminal defense cases.

This week, one of his law firm’s attorneys had to request more time to file a response in a federal gender-discrimination case in which a female Citrus County sheriff’s deputy claims she was demoted by her employer because of her sex.

The firm’s attorney representing the deputy cited the TrialWorks’ software problem, saying the company “has shut down access” to critical documents in the case. The law firm needed the documents to address a dispute over the testimony of an expert witness for Citrus County. Its response was due Friday.

“Since Oct. 11, 2019, plaintiff’s counsel, as well as other TrialWorks clients, have been been unable to access documents,” says the law firm’s motion requesting more time. “As of Oct. 24, 2019, plaintiff’s counsel remains unable to access all the necessary documents required to respond.”

The deadline issue was quickly resolved because attorneys for Citrus County did not oppose the law firm’s request. Melton’s firm has until Nov. 14 to respond, assuming it can gain access before then to crucial records at TrialWorks.

Jay Weaver writes about bad guys who specialize in con jobs, rip-offs and squirreling away millions. Since joining the Miami Herald in 1999, he’s covered the federal courts nonstop, from Elian’s custody battle to A-Rod’s steroid abuse. He was on the Herald team that won the Pulitzer Prize for breaking news in 2001. He and three Herald colleagues were Pulitzer Prize finalists for explanatory reporting in 2019 for a series on gold smuggled from South America to Miami.