Appleby breach: Financial secrets of super-rich clients may be leaked after offshore law firm hack

Appleby, a major law firm founded in Bermuda and managed out of Jersey, has said the financial details of super-rich clients may be leaked after it suffered a major data breach last year. The offshore firm said it suffered a "data security incident" in 2016 that "involved some of our data being compromised".

The firm is currently warning clients, including some of the wealthiest people in the UK, that their sensitive information may be leaked after it was approached by the media group behind the reporting of the Panama Papers, The Telegraph first reported.

In 2015, the International Consortium of Investigative Journalists (ICIJ) released the so-called Panama Papers, a cache of 11.5 million leaked financial documents from the world's fourth biggest offshore law firm, Panama City-based Mossack Fonseca. Disclosures from the Panama Papers shook the global political elite and triggered investigations into many public figures across the globe.

Some notable figures named in the leak, dubbed the biggest leak in the history of data journalism, were close associates of Russian President Vladimir Putin, Iceland's then prime minister Sigmundur Gunnlaugsson, Barcelona star Lionel Messi and former Pakistani prime minister Nawaz Sharif.

The US-based ICIJ has been analysing the data from Appleby and is expected to release the information shortly, the Times reported.

Appleby said it has received enquiries from the ICIJ and a number of its media partners regarding "documents that journalists claim to have seen and involve allegations made against our business and the business conducted by some of our clients".

The company has offices in a number of tax havens including British Virgin Islands, the Cayman Islands, Guernsey, Jersey, Mauritius, the Isle of Man and the Seychelles.

The company denied any allegations of wrongdoing.

"We take any allegation of wrongdoing, implicit or otherwise, extremely seriously," the company said in a statement on Wednesday (24 October). "Appleby operates in highly regulated jurisdictions and like all professional organisations in our regions, we are subject to frequent regulatory checks and we are committed to achieving the high standards set by our regulators. We are also committed to the highest standards of client service and confidentiality.

"Appleby has thoroughly and vigorously investigated the allegations and we are satisfied that there is no evidence of any wrongdoing, either on the part of ourselves or our clients. We refute any allegations which may suggest otherwise and we would be happy to cooperate fully with any legitimate and authorised investigation of the allegations by the appropriate and relevant authorities."

The company said it advises its clients on "legitimate and lawful ways to conduct their business" and does not "tolerate illegal behaviour."

"It is true that we are not infallible," the firm continued. "Where we find that mistakes have happened we act quickly to put things right and we make the necessary notifications to the relevant authorities."

Following the data breach, Appleby said it has reviewed its "cybersecurity and data access arrangements" together with a leading IT forensics team and is "confident that our data integrity is secure". However, the company did not offer any specific details regarding when or how the data breach occurred or how many clients were potentially affected.

"We are disappointed that the media may choose to use information which could have emanated from material obtained illegally and that this may result in exposing innocent parties to data protection breaches," it added. "Having researched the ICIJ's allegations we believe they are unfounded and based on a lack of understanding of the legitimate and lawful structures used in the offshore sector."

<sup>Note: This article was updated to reflect that Appleby is not based in Bermuda and is managed out of Jersey.