Troutman Pepper Locke LLP
August 7, 2026
•[ social, phishing, ransomware ]
A Troutman Pepper Locke employee was deceived by communications that appeared legitimate and sent documents to an unauthorized party on August 7, 2026. The firm said the unauthorized party never accessed its environment and operations were not affected. Silent Ransom Group subsequently claimed responsibility and published data.
magnals.com
October 6, 2026
•[ ransomware, leak, legal ]
magnals.com was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Other. Country: United States of America. Website: magnals.com. confidential data belonging to all these companies; magnals.com is responsible for the leak.
alunanuova@magnals.com
sraynal@magnals.com
info@ranshelpfi.com
kcawley@kirkland.com
pforan@hueston.com
mtodisco@hueston.com
sschnier@hueston.com
tking@hueston.com
lcohen@omm.com
lhack@motleyrice.com
monica.pedroza@morganlewis.com
thomas.hilton@morganlewis.com
kvose@motleyrice.com
lshaarda@motleyrice.com
mmontoya@skikos.com
tamara.giulianelli@morganlewis.com
karl.stampfl@kirkland.com
lshuler@hueston.com
khermiz@motleyrice.com
zachary.byer@kirkland.com
paul.weeks@kirkland.com
mpendell@motleyrice.com
mrivera@kirkland.com
mrobinson@robinsonfirm.com
zac.ciullo@kirkland.com
kcalcagnie@robinsonfirm.com
mcrawford@skikos.com
pdagostino@robinsonfirm.com
maureen.barber@morganlewis.com
pwilson@occourts.org
judith.hanratty@morganlewis.com
lelliott@motleyrice.com
Paulie.Fabian@da.ocgov.com
kding@hueston.com
mkaba@hueston.com
jhueston@Hueston.com
lstarks@hueston.com
mpurpura@hueston.com
smayer@hueston.com
tbecerra@omm.com
rebecca.zieben@morganlewis.com
kgrossman@omm.com
jschneller@omm.com
rmassing@hueston.com
mkaiser@omm.com
meimark-itc-1290@meimark.com
rwells@meimark.com
kdeighan@calfee.com
jhartman@merchantgould.com
jmiller@merchantgould.com
dylansuggsvideo@gmail.com
mso@levinperconti.com
MMirkovic@levinperconti.com
production@magnals.com
b.scott@magnals.com
samuel.ventresca@blankrome.com
JFeigenbaum@PostSchell.com
dspencer@magnals.com
jfrancis@magnals.com
dbrown@magnals.com
nbernik@magnals.com
mcantu@magnals.com
shorwitz@maganls.com
jtaran@jtaranlaw.com
michael@martinovskylaw.com
lori@costanzo-law.com
lucy.goodnough@costanzo-law.com
lawdesk@lex-omni.com
babbdesignsinc@gmail.com
gt@turitzadr.com
fburke@burkemediation.com
skaplan@Steptoe.com
mail@questvideoservice.com
balindadunlap@yahoo.com
lucy.marrone@costanzo-law.com
smisbah@steptoe.com
standard
shorwitz1@gmail.com
jnuttall@Steptoe.com
ktellez@steptoe.com
casey.griffin@ankura.com
marc.blanch@ankura.com
ECarapella@littler.com
rwangsness@occourts.org
mdjuric@omm.com
vharting@occourts.org
rhickman@magnals.com
revaldez@omm.com
cmonroe@motleyrice.com
csuarez@Steptoe.com
tfu@Steptoe.com
jcooper@steptoe.com
nathan.carpenter@dlapiper.com
sivakumarm@ballardspahr.com
sbylina@ziliak.com
disaacs@morrisoncohen.com
Michelle.Gorman@lewisbrisbois.com
kayla.clark@morganlewis.com
djensen@skikos.com
rklink@motleyrice.com
katherine.vaky@morganlewis.com
madock@rescar.com
aschaffer@rescar.com
mshepard@babstcalland.com
carolwarfield2005@yahoo.com
mlmarais@gmail.com
sean.nicholson@cornell.edu
justin.mccrary@gmail.com
minnie@b-henry.com
BVinci@duanemorris.com
jgoldsmith@magnals.com
mdundervill@motleyrice.com
karen.angelo@lewisbrisbois.com
rbaeza@bsfllp.com
vayala@bsfllp.com
teutafani@quinnemanuel.com
violatrebicka@quinnemanuel.com
joten@hueston.com
ddelgrande@hueston.com
edunbar@magnals.com
bmccafferty@magnals.com
VNestor@magnals.com
MJimenez@ktanda.com
HValgoi@magnals.com
VRice@ktanda.com
HPorter@CHDLawyers.com
eflorian@coplancrane.com
david@yegeresq.com
scaldwell@pmtlawfirm.com
gstrong@gllawgroup.com
mguararra@guararralaw.com
RFUMO@travelers.com
manan74@yahoo.com
johara@fbzlaw.com
dperkins@robinsonfirm.com
sfranklin@magnals.com
sarajenkins@quinnemanuel.com
dstraite@dicellolevitt.com
brichardson@BSFLLP.com
rmcgee@forthepeople.com
jcabezas@forthepeople.com
wsangster@magnals.com
SWood@chuhak.com
cemling@cyp-law.com
chartley@magnals.com
RKrishnapriyan@durietangri.com
enyborg-burch@bsfllp.com
trodriguez@bsfllp.com
jomairecrawford@quinnemanuel.com
carlspilly@quinnemanuel.com
eharding@magnals.com
ABrausa@durietangri.com
VRanieri@durietangri.com
drew@kzllp.com
michael@skipti.com
ttucker@calfee.com
bliu@calfee.com
dlikens@calfee.com
outsider12b@hanmail.net
ProcopioITC1290@procopio.com
youngmin.hwang@lge.com
hojun.suh@lge.com
jaeoak.kho@lge.com
jin.seomoon@lge.com
Nicholas.jackson@dentons.com
Kevin.greenleaf@dentons.com
Tyler.goodwyn@dentons.com
Mark.hogge@dentons.com
Song.jung@dentons.com
alexjo.translator@gmail.com
annpark@pacls.com
kuyoung.son@lge.com
byunghwan.ahn@lge.com
tg.kong@lge.com
ejmichelle@gmail.com
Vivian.sandoval@dentons.com
Matthew.sim@dentons.com
Nah-eun.kim@dentons.com
jhochberger@meimark.com
jzhang@meimark.com
mei@meimark.com
rmyers@prmpclaw.com
kfisch@Steptoe.com
sreid@steptoe.com
willowashlynn@gmail.com
vikashni@vashlegalservices.com
sbowlby@plunkettcooney.com
arodas@magnals.com
rkappers@steptoe.com
tyebernetsky@Steptoe.com
dgelwicks@Steptoe.com
kcappaert@steptoe.com
bholt@steptoe.com
tmurray@magnals.com
amanda@levinzeiger.com
mmiller@steptoe.com
johnsmith@supercoolattorneys.org
AnnieLee@mofo.com
ckwark@steptoe.com
pbirdsall@steptoe.com
johnsmith@magnals.com
VCTeam@magnals.com
Legis
September 23, 2026
•[ ransomware, technology, finance ]
Legis was listed as a victim on the leak site of the rhysida ransomware group; the attack is estimated to have taken place on 2026-09-23. Sector: Professional Services. Legis Legis is a well-known Latin American publisher that creates specialized legal and business information resources. Founded over 60 years ago, the company serves professionals across six countries including Colombia, Venezuela, Argentina, Mexico, Peru, and Chile.DATABASES (SQL)PST/OSTLEGAL DOCUMENTS:Tutela - constitutional actions with claimants' personal dataID card copies (cedulas) of shareholders and third partiesEnvironmental sanction proceedings against the company (AUTO 10852)Sanction dispute with the pension authority (UGPP)Signed cease & desist - trademark dispute (Xpandia case)Personal data transfer agreements (Colsubsidio, Universidad Externado)Litigation log of all company lawsuitsContract matrix, payment agreements, reorganization documentsFINANCE & OWNERSHIP:Shareholder and ultimate-beneficial-owner register with ID copiesOwnership structure: ~99.94% held by a single ownerDividend payment recordsDebt write-off letters naming debtors and amountsFinancial and tax reporting (exogena, estados financieros)CUSTOMERS:Customer databases: law firms, universities, government contractorsIncluding Ecopetrol, Halliburton, the AIM state agency, hundreds of companiesTax IDs (NIT), contacts, contract history More
NEAD Pro
September 24, 2026
•[ ransomware, finance, legal ]
NEAD Pro was listed as a victim on the leak site of the rhysida ransomware group; the attack is estimated to have taken place on 2026-09-24. NEAD Pro Nead Pro is a professional multidisciplinary firm based in Gorizia and Udine, Italy, that provides legal, tax, bankruptcy, and accounting consulting services.What it is: a network share belonging to two Italian professional firms located at Via Roma 20, Gorizia (Friuli-Venezia Giulia):NEAD SRL (NORTH EAST ADVISORS S.R.L.) - an accounting firm, dottore commercialista, P.IVA 01114220310, REA GO-72906;NEAD PRO - PROFESSIONISTI RIUNITI - a law firm, P.IVA 01157140318.Volume: ~575,000 files / ~253 GB. The root contains a single branch Nuova directory\NEAD\ (plus an empty Documenti folder and a scatter of PDF scans at the root level).Structure and contents:Branch Volume ContentsNEAD PRO SITE - Documenti 231,137 files / 193.5 GB Law firm: 03.PRATICHE (46,620 files: CIVILE 9,665, PENALE 537, SOVRAINDEBITAMENTO 1,208), 04. INCARICHI (85,321: FALLIMENTI 22,492, ESECUZIONI 28,509, ADS 14,547, TRUST, CURATELE), SEGRETERIA with CREDENZIALI VARIE.xlsx (~40 firm accounts: SPID, PEC, banks, 2 cards with full PAN+CVC, safe code), bank scans (BANCOMAT PIN, BCC agreements)NEAD SRL SITE - Documenti 101,125 / 55.3 GB Accounting firm: 03.CLIENTI - 199 active + 184 former client folders (730, CU, F24, contracts), 44 private SOGEI Entratel .P12 keys (signing clients' tax returns), ISA/IRAP tax filings 20192020, client master data, Account.xlsxPRIMA NOTA - Documenti 1,885 / 871 MB Cash books 20192026 (21 xlsx): CASSA / CONTO CORRENTE / POS / CARTA / SISTERPOWERBI - Documenti 548 / 627 MB 37 financial BI models .pbix (BI_ISIDE, BI_NEAD, ATHENA, PNAI)ARCHIVIO 921 / 2.6 GB MPS bank statements 20202024, NEAD SRL account closure, firm mail archivePOSTA SARDAMAR / PANEGIOCHI / ISIDE / ADMIN SRL ~165+ / ~174 MB Client and firm mail: IVECO Capital leasing, accertamento Agenzia Entrate, Capitaneria di Porto, verbali poliziaES. IMM. 112-2024 10 files Real-estate enforcement proceedings (Tribunale di Gorizia): bank statements and CIE (ID cards) of auction participantsNEAD root ~85 PDF / 127 MB Scanned bank statements, F24 forms, IPZS envelope with the PIN/PUK of a CIE cardMost sensitive data: client dossiers with tax codes (codici fiscali), court case files (civil/criminal/bankruptcy), medical documents (Art. 9 GDPR), the firm's credential database with full PAN+CVC of two cards and the safe code, 52 Entratel electronic signature keys, ~100 SEPA mandates with IBANs and signatures, client PST archives (7.5 GB), a client's Huawei phone backup (Facebook/Gmail/Telegram databases), passports of foreign shareholders. More
Pierce Township
August 14, 2026
•[ ransomware, government, healthcare ]
Pierce Township was listed as a victim on the leak site of the rhysida ransomware group; the attack is estimated to have taken place on 2026-08-14. Sector: Government & Defense. Country: United States of America. Website: piercetownship.org. Pierce Township Pierce Township is a growing community in Ohio that blends rural charm with suburban living, covering 23.5 square miles and home to over 16,000 residents.We are pleased to present:Judicial materials - Grand Jury subpoena response incl. hospital records (Mercy Hospital), public records requests, fire investigation reportsEmployee PII - Social Security numbers (SSA-1945, W-4, Ohio Tax forms), CDL licenses, health insurance waivers, new-hire packetsLegal settlements - Logan Creek v. Pierce Township, Purdue opioid settlement, easement and lease agreementsFinancial records - budgets, tax levies, appropriation reports, invoices, paymentsInternal email archives of township officials and administration More
SHAHEEN LAW GROUP PLC - Richmond, Virginia, USA
August 24, 2026
•[ ransomware, leak, finance ]
SHAHEEN LAW GROUP PLC - Richmond, Virginia, USA was listed as a victim on the leak site of the Deadlock ransomware group; the attack is estimated to have taken place on 2026-08-24. Sector: Professional Services. Country: United States of America. Website: slgjustice.com. Family law firm, established 1995 by Victor A. Shaheen (2025 - the General Assembly of Virginia honored him with a resolution; google it, it is touching). Now run by his three sons. 48 employees across four offices: Richmond, Midlothian, Virginia Beach, Newport News. What do they do? They close 150+ real estate transactions EVERY MONTH for some of the largest corporate relocation programs in America. When a Fortune-500 moves an employee to Virginia, this firm holds that employee's Social Security Number, bank wiring details, home address, family identities, and sometimes their medical clearance. They hold everyone's future in a shared folder. We now hold the folder. WHAT WE TOOK 36,788 files 27GB 21,789 fully read 67,000+ SSN patterns (their own dedup says 6,017 real people we will let their customers decide which number to believe) EVIDENCE SERIES PREVIEW (from their actual files) - S1 DEEDS WITH SOCIAL SECURITY NUMBERS File: "5053815 - Unsigned Deed.docx" (verbatim from their server): "***-**-XXXX B H Social Security Number ***-**-XXXX J H Social Security Number 10356 Ashburn Road, North Chesterfield, VA 23235" File: "Kelley 5042085 - DEED.docx": "PURCHASER(S): N S SELLER'S NAME: S E. K SS#: ***-**-XXXX ...including the withholding of twenty percent (20%) of the sales proceeds." FIRPTA: foreign sellers. IRS will want this list. We have it. Thousands of these. Every deed folder = a name, a number, an address, a transaction. Their client roster IS the leak. - S3 INSIDE THEIR BANKING & THEIR NETWORK File: "shared_Accounting/Banking/Other Banking/Shaheen DDA Statements SunTrust DDA" (email from SunTrustOnlineCourier to their own staff headers verbatim): Received: from barracuda.shaheenlaw.com ([10.0.0.6]) by ricdcex1.shaheenlaw.com ... X-ASG-Debug-ID: 1291233029-... for ; Wed, 1 Dec 2010 Why we publish an email HEADER: their internal map is in it. Barracuda at 10.0.0.6. Exchange "ricdcex1". Domain SHAHEENWORLD. We did not forget how to enter. Neither will the next group, when we sell the map. 150 banking statement attachments ride along in this folder. - S5 THE CLIENT LIST, WRITTEN IN FOLDERNAMES They named folders after their customers. Verbatim paths: shared_PENDING_SALE/HENNY/Closed Files/ Wisniewski-Markel, Suzanne_5027384_12263 Eagle ... Merza, Jamal & Adrienne_5027826_811 Woodberry ... Name, file number, STREET ADDRESS in the path itself. Marketing lists sell for money. This one is annotated with purchase history. Relocation buyers are premium leads. - S2 MEDICAL - S4 LITIGATION Held. 120 medical files exist (their own audit counted them). Litigation: we confirm their December escrow dispute is public (Porchlight Homes v. Almeida & Shaheen, Henrico google it, BizSense covered it). Virginia residents: 18.2-186.6. Illinois relocations: BIPA. Opposing counsel and journalists: samples on request. Media & researchers: samples on request, we answer fast We keep our word to everyone who pays. We keep it also to everyone who does not.
Plaxen & Adler
June 10, 2026
•[ ransomware, legal ]
Plaxen & Adler was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-06-10. Country: Germany. Website: www.plaxenadler.com.
Roger D. Mason II, P.A.
April 16, 2026
•[ ransomware, legal, finance ]
Roger D. Mason II, P.A. was listed as a victim on the leak site of the pear ransomware group; the attack is estimated to have taken place on 2026-04-16. Sector: Professional Services. Country: United States of America. Website: flautolawyer.com. Florida Auto Dealership Fraud Attorney
defenseisready.com
May 15, 2026
•[ ransomware, technology, legal ]
defenseisready.com was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-05-15. Sector: Technology. Country: United States of America. Website: defenseisready.com. Deandra Grant Law is a Texas criminal defense and DWI firm with a practice exclusively concentrated on DWI, federal and criminal defense. The firm has defended clients across North and Central Texas for more than 30 years, with more than 500 cases tried to verdict.
maisonlaw.com
December 19, 2025
•[ ransomware, legal ]
maisonlaw.com was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2025-12-19. Sector: Professional Services. Country: United States of America. Website: maisonlaw.com. Maison Law provides skilled, experienced, and personalized legal guidance to the voiceless and the injured in the Central Valley.
Hopkins Law
March 3, 2026
•[ ransomware, legal, leak ]
Hopkins Law was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-03-03. Sector: Professional Services. Country: United States of America. Website: hopkins.law. Hopkins Barvi & Hopkins, P.L.L.C. is your trusted Gulf Coast firm for personal injury, business litigation, and family lawfiercely protecting your rights while guiding you with honesty, respect, and genuine care.
Notaría 89
March 19, 2026
•[ ransomware, legal, finance ]
Notara 89 was listed as a victim on the leak site of the payload ransomware group; the attack is estimated to have taken place on 2026-03-19. Sector: Professional Services. Country: Mexico. Website: notaria89.com.mx. Data size claimed by the group: 85 GB. Notara 89 Edomex, located in the State of Mexico, offers specialized legal services for various real estate transactions and contracts. Under the leadership of Licenciado Luis Octavio Hermoso y Coln, the notary public provides services such as the granting of powers, purchase contracts, real estate mortgages, and the constitution of societies. The notary public also handles testaments and other notarial services, ensuring all legal requirements are met for property transfers and other legal matters.
Fong Ilagan, LLP
February 17, 2026
•[ ransomware, legal ]
Fong Ilagan, LLP was listed as a victim on the leak site of the genesis ransomware group; the attack is estimated to have taken place on 2026-02-17. Sector: Professional Services. Country: United States of America. Website: fonglegal.com. An immigration law firm from Texas, USA.
The Odom Firm
February 23, 2026
•[ ransomware, legal ]
The Odom Firm was listed as a victim on the leak site of the pear ransomware group; the attack is estimated to have taken place on 2026-02-23. Sector: Professional Services. Country: United States of America. Website: mecklaw.com. Representing individuals and businesses in matters related to easements, agreements, and zoning, including variances and appeals
Vishnick McGovern Milizio
December 13, 2025
•[ ransomware, legal ]
Vishnick McGovern Milizio was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2025-12-13. Sector: Professional Services. Country: United States of America. Website: www.vmmlegal.com.
feldmanandlopez.com
October 22, 2025
•[ ransomware, legal ]
feldmanandlopez.com was listed as a victim on the leak site of the safepay ransomware group; the attack is estimated to have taken place on 2025-10-22. Sector: Professional Services. Country: United States of America. Website: feldmanandlopez.com. Feldman & Lopez, P.A. is a law firm based in Miami, Florida, that specialises in property insurance law and related
prutsch-ra.at
November 6, 2025
•[ ransomware, legal, financial ]
prutsch-ra.at was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2025-11-06. Sector: Professional Services. Country: Austria. Website: prutsch-ra.at. We have data from Piaty Mller-Mezin Schoeller Rechtsanwlte GmbH, payment and tax records, employee and client documents, as well as projects and developments, and personal correspondence with clients.
Eckert Seamans Cherin & Mellott LLC
April 17, 2025
•[ data leak, legal, insufficient security ]
Eckert Seamans detected unauthorized activity on an attorneys device on April 17, 2025, and confirmed that a document listing alumni was copied. The firm began notifying affected individuals on June 23, 2025, offering identity protection services and notifying regulators and law enforcement. Class action filed Aug 4, 2025, alleging failure to safeguard PII.
