A prominent global crisis and communications firm, Sodali, is confronting a potential data breach after a ransomware group, Brain Cipher, claimed to have hacked its systems, exposing thousands of sensitive documents. The cyberattack reportedly targeted Sodali’s international offices, raising concerns about the security of confidential client information related to major corporate transactions.
Brain Cipher, known for its ransomware-as-a-service operations, announced the breach on October 22, stating it had obtained approximately 13,000 documents connected to Sodali’s activities in Germany, Switzerland, and other non-Australian locations. The leaked files allegedly include corporate records, voting schedules, proxy adviser reports, commercial proposals, pricing strategies, and executive search materials. The group’s previous high-profile cyber intrusions include unauthorized access to the Indonesian National Data Centre in 2024, where it demanded an $8 million ransom.
Sodali, which provides investor relations and communications support to some of the world’s largest corporations, including Australian clients such as Oliver Curtis’s Firmus, Premier Investments, Mike Cannon-Brookes, Solomon Lew, and WiseTech Global’s Richard White, has remained tight-lipped about the incident. The firm confirmed awareness of the claims through a spokesperson but described them as “unverified” and reiterated its commitment to protecting confidential information.
“As soon as we became aware of these claims, we engaged external experts to investigate and assess any potential impact,” the spokesman said. He added that Sodali’s operations continued as normal and that safeguarding the information entrusted to them by clients, employees, and partners was a top priority.
Sodali plays a significant role in advising on mergers and acquisitions and holds access to highly sensitive, non-public information. The alleged breach is a particular concern given the company’s involvement in managing high-stakes corporate transactions, including the troubled float of Firmus, which failed to meet expectations. The failure has pushed Firmus’s founders towards private capital and Wall Street investors, casting uncertainty over anticipated fees exceeding $200 million that would have been payable to banks and brokers associated with the deal.
The cyberattack places additional pressure on Sodali’s private equity owner, TPG Capital, which acquired the firm in 2022 with a planned seven-year investment horizon. TPG Capital faces challenges in navigating the aftermath of the breach while managing its strategic plans for divestment. Sodali’s Australian operations have undergone consolidation through the absorption of Domestique and Citadel Magnus, though some former employees have since formed competing firms.
Under increasing scrutiny, Sodali is reportedly contacting clients amid concerns that more than 100 entities may have had their data compromised. Australian companies must report data breaches to the Office of the Australian Information Commissioner and the Australian Signals Directorate, raising the possibility of regulatory investigations.
Sodali’s leadership, including Chief Commercial Officer Brett Clegg and Chief Executive Andrew Benett, declined to provide further comment beyond the official statement. Meanwhile, former principal Ross Thornton has recently returned to the company in a part-time role, providing additional experience as the firm manages the fallout from the security incident.