Herron Todd White Listed by meow Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Herron Todd White, one of Australia’s largest independent property valuation and advisory firms, was listed by the ransomware group meow on or around 5 April 2024. The group claims to have exfiltrated more than 298 GB of confidential internal files in a ransomware attack. The number of people affected remains unknown, and public detail on the precise method and full scope of the incident is limited.

For clients, staff and counterparties who have shared personal or commercial information with the firm, the listing raises clear questions about what data may now be in unauthorised hands and what practical steps they should take.

What happened

According to the available record, Herron Todd White was listed by the meow ransomware group on 5 April 2024. The group stated that it had obtained exclusive access to over 298 GB of confidential data belonging to the firm. The data is described only as internal files exfiltrated in a ransomware attack. No further Reported Details have been released about the date of intrusion, the initial access vector, whether systems were encrypted, or whether any ransom demand was made or paid. The number of individuals whose information may be involved is listed as unknown.

Public reporting on the incident rests on the group’s own leak-site claim. Independent verification of the volume, contents or authenticity of the claimed data set has not been provided in the available facts.

The group behind it: meow

meow is a ransomware operation that has appeared on public leak sites in recent years. Like many such groups, it typically claims to have stolen data before or instead of encrypting systems, then lists the victim and advertises the material for sale or free release. The group’s postings often include promotional language about the size and sensitivity of the haul and invite buyers or other parties to obtain the files. Prior activity by meow has followed this pattern of data-exfiltration claims followed by public listing, though each incident must be assessed on its own evidence.

In this case the group claims to hold more than 298 GB of confidential material from Herron Todd White. That assertion remains an unverified claim by the actors themselves; the facts do not record any independent confirmation of the data’s contents or completeness.

Who is Herron Todd White?

Herron Todd White is an Australian property valuation and advisory firm that operates across residential, commercial and rural sectors. Firms of this type routinely handle property valuations, market reports, client instructions and related commercial documentation. They typically hold personal details of property owners and buyers, financial and ownership information, and commercially sensitive assessments prepared for lenders, investors and private clients.

Because the firm’s work sits at the intersection of personal property records and commercial decision-making, any unauthorised exposure of its internal files can affect both private individuals and business counterparties who rely on the confidentiality of those records.

What was likely exposed

The facts state that internal files were exfiltrated in a ransomware attack and that the group claims the volume exceeds 298 GB of confidential data. No further breakdown of file types, document categories or personal-data fields has been disclosed. Organisations engaged in property valuation commonly hold names, addresses, contact details, ownership records, valuation reports, financial summaries and correspondence with clients and lenders. Whether any of those categories are present in the claimed data set remains unconfirmed.

Until the exact contents are verified by the organisation or by independent analysis, it is not possible to state with certainty what specific information was taken. The only confirmed description is “internal files” linked to the ransomware claim.

What's at stake

For individuals whose details may appear in the firm’s records, the principal risks are identity misuse, targeted phishing that references genuine property or valuation information, and potential exposure of financial or ownership circumstances. For commercial clients the same files could reveal market positions, transaction details or internal assessments that competitors or other parties might exploit. The organisation itself faces operational disruption, regulatory scrutiny under Australian privacy rules, and the longer-term cost of investigating and remediating the incident.

Because the number of affected people is unknown and the precise data types remain undisclosed, the scale of these risks cannot yet be quantified. The absence of confirmed detail does not eliminate the possibility of harm; it simply means affected parties must proceed on the basis of prudent caution rather than confirmed exposure lists.

What to do if you're exposed

Anyone who has dealt with Herron Todd White and is concerned their information may have been involved should monitor bank and credit accounts for unusual activity, be alert to unsolicited messages that reference property or valuation details, and consider placing fraud alerts with relevant credit-reporting bodies. Changing passwords on related online accounts and enabling multi-factor authentication where available are practical immediate steps. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets. If official notification or further guidance is issued by the firm or by Australian regulators, follow those instructions promptly.

AICompiled with AI assistance from public sources and published under our editorial standards.