Hills Legal Group Ltd Listed by 8base Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On November 22, 2023, Hills Legal Group Ltd was listed by the ransomware group known as 8base. Public reporting states that internal files were exfiltrated in a ransomware attack. The number of people affected remains unknown, and wider details about timing, intrusion method, and the precise scope of the incident have not been disclosed.

For a litigation-focused law firm, any confirmed or claimed exposure of internal files carries weight because such material can include client-related records and operational documents. What is established so far is limited to the listing itself and the description of internal files taken during a ransomware attack; everything beyond that is unconfirmed.

Breaking down the breach

According to available information, Hills Legal Group Ltd appeared on 8base’s listings on November 22, 2023. The report describes internal files as having been exfiltrated in a ransomware attack. No figure has been given for the volume of data, the number of individuals potentially affected, or the exact date the intrusion began or was discovered. The technical method of access—whether through phishing, exploited vulnerabilities, compromised credentials, or another route—has not been made public.

Ransomware incidents commonly involve both encryption of systems and theft of data before encryption, with the stolen material then used as leverage. In this case, the public record states that internal files were taken. It does not confirm whether systems were encrypted, whether a ransom demand was issued or paid, or whether the firm has authenticated the group’s claims. The listing by 8base should be treated as an assertion by the group rather than independently verified fact unless further confirmation emerges.

Because people-affected counts and detailed inventories of what left the network are undisclosed, anyone connected to the firm—clients, staff, or counterparties—has only the high-level description to work from at present.

Inside 8base

8base is a ransomware operation that has been observed since at least 2022–2023. Like many groups in this category, it typically follows a double-extortion model: data is copied out of the victim environment, systems may be encrypted, and the group then threatens to publish the stolen material on a leak site if its demands are not met. Listings on such sites serve as both pressure and advertising for the group’s activity.

Public reporting on 8base has described the use of common initial-access techniques seen across the ransomware ecosystem, followed by data theft and, in many cases, deployment of encryptors. The group has named organisations across multiple sectors on its leak site. Specific claims 8base makes about any single victim, including Hills Legal Group Ltd, remain the group’s own statements until corroborated by the organisation or by independent investigation. No additional statements from 8base about this particular incident—beyond the fact of the listing and the reference to internal files—are included in the available facts.

Who is Hills Legal Group Ltd?

Hills Legal Group Ltd is a law firm that, according to its own description, has focused for more than thirty years on litigation, including trial and appellate representation. The firm emphasises thorough defence work, experienced and economical representation, and attention to cases regardless of size. It has cited an AV rating from Martindale-Hubbell, reflecting high marks on legal ability and ethical standards as assessed by that directory.

Law firms of this type routinely hold correspondence, pleadings, discovery materials, client contact details, billing records, and internal work product. Because litigation often involves sensitive personal, financial, or commercial information belonging to clients and sometimes to opposing parties or witnesses, a breach affecting internal files is consequential. Even without a public tally of affected individuals, the nature of the practice means that exposure could touch people who entrusted the firm with confidential matters.

The information in question

The facts state that internal files were exfiltrated in a ransomware attack. No further breakdown—such as whether the files included client matter documents, emails, financial records, employee data, or other categories—has been disclosed. The number of people affected is unknown.

Organisations in the legal sector typically maintain case files, identity and contact information, correspondence, and administrative records. It is reasonable to expect that some combination of those materials could fall under “internal files,” yet it would be inaccurate to assert any specific data type as confirmed beyond what has been reported. Exact contents remain unconfirmed. Anyone who has been a client or employee should treat the possibility of exposure seriously while recognising that public detail is limited.

What's at stake

For individuals, the practical risks depend on what was actually taken. If client or personal data were among the internal files, possible outcomes include unwanted contact, attempts at social engineering that reference real case details, or misuse of identity information. Litigation files can contain facts people regard as private; their appearance outside the firm’s control can cause distress and, in some situations, create leverage for further fraud.

For the firm, stakes include operational disruption, regulatory and professional obligations around client confidentiality, potential notification duties, and reputational harm. Legal practices are bound by ethical rules on safeguarding client information; a ransomware incident that involves data theft tests those obligations regardless of whether negligence is ever established. The facts do not assert fault; they record a claimed listing and the exfiltration of internal files.

Because the scale is unknown, the full population of people who may need to take precautions cannot yet be defined. That uncertainty itself is part of the impact: clients and staff may need to heighten vigilance without knowing whether their own information was involved.

What to do if you're exposed

If you have a past or present relationship with Hills Legal Group Ltd—as a client, employee, or other party—consider practical steps. Monitor accounts and credit reports for unfamiliar activity. Be cautious of unexpected messages that reference legal matters, the firm, or personal details; verify any such contact through known official channels rather than replying directly. Change passwords on related accounts if you reuse credentials, and enable multi-factor authentication where available. Preserve any notice you receive from the firm and follow instructions it provides.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach datasets. That check does not confirm or rule out involvement in this specific incident, but it can indicate whether your details are circulating more widely and help you prioritise further monitoring.

AICompiled with AI assistance from public sources and published under our editorial standards.