64 Law Firms Leaked, Troutman Pepper Locke Included
Silent Ransom Group (SRG) has published data from 64 law firms on its data leak site, up from 38 in April and 48 by June 29. The group, a Conti offshift active since 2022 and also tracked as Luna Moth, Chatty Spider, and UNC3753, focuses on data theft and extortion rather than file encryption, a tactic that has made it a persistent threat against legal services.
Troutman Pepper Locke is among the newly leaked firms, with tens of thousands of Social Security Numbers exposed. The firm has not yet confirmed the breach or the scope of client data exposed, but SRG’s DLS listing includes the full payload. The leak follows SRG’s pattern of targeting law firms that handle privileged communications, subpoenas, and ongoing litigation files — the "crown jewels" that make victims pay to keep data from being published or sold.
What SRG Steals and How It Gets In
SRG gains initial access through a BazarCall-style callback phishing campaign. Victims receive an email about a fictitious charge and are instructed to call a phone number. Once connected, the user is walked through a remote access session that drops a backdoor and gives the group a foothold on the endpoint. From there, SRG moves laterally across the network to exfiltrate the data they need.
The group does not encrypt files. It steals the data and holds it for ransom. If the victim doesn’t pay, SRG publishes the payload on its data leak site at business-data-leaks[.]com, which it has operated since December 2024 when it first branded itself as LeakedData. The DLS runs on the clearnet rather than Tor, making it easier for victims to view the leak without a Tor browser.
Tactics include IT impersonation, social engineering, and supply-chain exploitation through third-party vendors. The vendor compromise lets SRG reach law firms through trusted connections, complicating detection and response. The group also uses physical intrusion against U.S. law firms, a tactic it has been running since June 2026.
Why Law Firms Are the Target
Law firms hold the data that makes victims pay. SRG targets them because the payload includes subpoenas, ongoing litigation files, intellectual property, and privileged attorney-client communications — the "crown jewels" that a firm cannot afford to see published or sold. When SRG exfiltrates, it is not encrypting the drive; it is holding the files hostage and threatening to publish or sell them if the ransom isn't paid.
That is why law firms are more likely to pay than a typical ransomware victim. The data is sensitive enough that a leak to a client or opposing counsel is a reputational and legal event, not just a file-restore problem. SRG's data-theft-only model bypasses the backup mitigation that works against encryption-based ransomware, and the group has been running this pattern against legal services since 2022.
Key points
- SRG's DLS now lists 64 law firms, up from 38 in April and 48 by June 29.
- Troutman Pepper Locke is among the newly leaked firms.
- Leaked data includes tens of thousands of client SSNs, subpoenas, and privileged communications.
- SRG uses data theft and extortion rather than file encryption, publishing data on business-data-leaks[.]com.
- The group has been active since 2022 and is a Conti offshift also known as Luna Moth and UNC3753.
Further reading & sources
- Troutman Pepper Locke Silent as Threat Actors Leak Client Data, Tens of Thousands of SSNs — DataBreaches
- Resecurity | Silent Ransom Group (SRG): Uncovering DNS Fast Flux Infrastructure
- Industrial Ransomware Analysis for Q2 2026
- Sicarii Ransomware Encryption Key Handling Defect
- BianLian ransomware gang shifts focus to pure data extortion
- Dark Web Profile: Silent Ransom Group (LeakedData)
- FBI disrupts the Dispossessor ransomware operation, seizes servers
- Ongoing Targeted Campaign Against US Law Firms | Google Cloud Blog
- INC Ransom's Law Firm Extortion: %58 Paid?
- Silent Ransom Group Hacked Greenberg Traurig; Who notifies the 126k Affected? (1)
- Conti ransomware gang member sentenced to 4 years in prison