This is a work in progress. While we strive for accuracy, some breach details may be incomplete or pending verification.

Kelly Legal

Summary

Kelly Legal, a Queensland-based law firm with offices in Brisbane and Mackay, suffered a ransomware attack on 10 October 2025 that caused an IT and phone system blackout. The INC Ransom group claimed to have exfiltrated more than 447 gigabytes of data including contracts, financial and customer data, and human resources information. The firm, which provides family law, real estate, workplace, and litigation services, warned clients to verify bank account details by phone before acting on any payment requests.

What Happened

On 10 October 2025, Kelly Legal experienced an overnight hacking incident that caused an IT and phone system blackout. The firm disclosed the incident via its Facebook page and confirmed it had fallen victim to a hacking attack. On 13 November 2025, the INC Ransom ransomware group listed Kelly Legal on its darknet leak site, claiming to have exfiltrated more than 447 gigabytes of data including contracts, financial records, customer data, and human resources information. INC Ransom threatened to publish the stolen data later in November.

Impact on Individuals

The breach potentially affects clients and employees of Kelly Legal. The stolen data includes client contracts, financial information, customer data, and human resources records. The firm warned clients to verify bank account details by phone before acting on any payment requests, indicating concern about potential financial fraud using the compromised information. Kelly Legal serves individuals and businesses across family law, real estate, workplace matters, and disputes and litigation.

Organisational Response

Kelly Legal disclosed the hacking incident via Facebook on 10 October 2025, warning clients about the IT and phone system blackout. The firm advised all clients and others to verify bank account details by phone before acting on any requests for funds, demonstrating awareness of potential fraud risks arising from the compromised data. The firm operates offices in Brisbane and Mackay and also runs the Property Law Centre.

Verification Source: View original statement