[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fXFuOUXEI48cPGrATGqxiSXMVFpWuD1KB1RacQE3zKQ4":3,"$fVBflDGmhBufLq9kYPXQnglbaRfbXqgLxKrUkcvzL2fs":84},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":16,"hero_image_url":17,"structured":18,"story_type":81,"created_at":82,"updated_at":83,"published_at":27},"silent-ransom-group-leaks-data-from-64-law-firms-exposing-tens-of-thousands-of-s","Silent Ransom Group Leaks Data from 64 Law Firms, Exposing Tens of Thousands of SSNs","SRG's DLS now lists 64 law firms, including Troutman Pepper Locke, with client SSNs and privileged documents exposed.","Silent Ransom Group has published data from 64 law firms on its data leak site, including Troutman Pepper Locke, exposing tens of thousands of client SSNs and privileged legal documents.",[10,11,12,13,14,15],"Silent Ransom Group","Troutman Pepper Locke","law firm","data leak","SSN","ransomware","# Silent Ransom Group Leaks Data from 64 Law Firms, Exposing Tens of Thousands of SSNs\n\n*SRG's DLS now lists 64 law firms, including Troutman Pepper Locke, with client SSNs and privileged documents exposed.*\n\n**Tags:** `Silent Ransom Group` `Troutman Pepper Locke` `law firm` `data leak` `SSN` `ransomware`\n\n> Silent Ransom Group has published data from 64 law firms on its data leak site, including Troutman Pepper Locke, exposing tens of thousands of client SSNs and privileged legal documents.\n\n---\n\n## 64 Law Firms Leaked, Troutman Pepper Locke Included\n\nSilent Ransom Group (SRG) has published data from 64 law firms on its data leak site, up from 38 in April and 48 by June 29. The group, a Conti offshift active since 2022 and also tracked as Luna Moth, Chatty Spider, and UNC3753, focuses on data theft and extortion rather than file encryption, a tactic that has made it a persistent threat against legal services.\n\nTroutman Pepper Locke is among the newly leaked firms, with tens of thousands of Social Security Numbers exposed. The firm has not yet confirmed the breach or the scope of client data exposed, but SRG’s DLS listing includes the full payload. The leak follows SRG’s pattern of targeting law firms that handle privileged communications, subpoenas, and ongoing litigation files — the \"crown jewels\" that make victims pay to keep data from being published or sold.\n\n## What SRG Steals and How It Gets In\n\nSRG gains initial access through a BazarCall-style callback phishing campaign. Victims receive an email about a fictitious charge and are instructed to call a phone number. Once connected, the user is walked through a remote access session that drops a backdoor and gives the group a foothold on the endpoint. From there, SRG moves laterally across the network to exfiltrate the data they need.\n\nThe group does not encrypt files. It steals the data and holds it for ransom. If the victim doesn’t pay, SRG publishes the payload on its data leak site at business-data-leaks[.]com, which it has operated since December 2024 when it first branded itself as LeakedData. The DLS runs on the clearnet rather than Tor, making it easier for victims to view the leak without a Tor browser.\n\nTactics include IT impersonation, social engineering, and supply-chain exploitation through third-party vendors. The vendor compromise lets SRG reach law firms through trusted connections, complicating detection and response. The group also uses physical intrusion against U.S. law firms, a tactic it has been running since June 2026.\n\n## Why Law Firms Are the Target\n\nLaw firms hold the data that makes victims pay. SRG targets them because the payload includes subpoenas, ongoing litigation files, intellectual property, and privileged attorney-client communications — the \"crown jewels\" that a firm cannot afford to see published or sold. When SRG exfiltrates, it is not encrypting the drive; it is holding the files hostage and threatening to publish or sell them if the ransom isn't paid.\n\nThat is why law firms are more likely to pay than a typical ransomware victim. The data is sensitive enough that a leak to a client or opposing counsel is a reputational and legal event, not just a file-restore problem. SRG's data-theft-only model bypasses the backup mitigation that works against encryption-based ransomware, and the group has been running this pattern against legal services since 2022.\n\n## Key points\n\n- SRG's DLS now lists 64 law firms, up from 38 in April and 48 by June 29.\n- Troutman Pepper Locke is among the newly leaked firms.\n- Leaked data includes tens of thousands of client SSNs, subpoenas, and privileged communications.\n- SRG uses data theft and extortion rather than file encryption, publishing data on business-data-leaks[.]com.\n- The group has been active since 2022 and is a Conti offshift also known as Luna Moth and UNC3753.\n\n## Further reading & sources\n\n- [Troutman Pepper Locke Silent as Threat Actors Leak Client Data, Tens of Thousands of SSNs](https:\u002F\u002Fdatabreaches.net\u002F2026\u002F08\u002F21\u002Ftroutman-pepper-locke-silent-as-threat-actors-leak-client-data-tens-of-thousands-of-ssns) — DataBreaches\n- [Resecurity | Silent Ransom Group (SRG): Uncovering DNS Fast Flux Infrastructure](https:\u002F\u002Fwww.resecurity.com\u002Fblog\u002Farticle\u002Fsilent-ransom-group-srg-uncovering-dns-fast-flux-infrastructure)\n- [Industrial Ransomware Analysis for Q2 2026](https:\u002F\u002Fwww.dragos.com\u002Fblog\u002Fdragos-industrial-ransomware-analysis-q2-2026)\n- [Sicarii Ransomware Encryption Key Handling Defect](https:\u002F\u002Fhalcyon.ai\u002Fransomware-alerts\u002Falert-sicarii-ransomware-encryption-key-handling-defect)\n- [BianLian ransomware gang shifts focus to pure data extortion](https:\u002F\u002Fbleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fbianlian-ransomware-gang-shifts-focus-to-pure-data-extortion)\n- [Dark Web Profile: Silent Ransom Group (LeakedData)](https:\u002F\u002Fsocradar.io\u002Fblog\u002Fdark-web-profile-silent-ransom-group-leakeddata)\n- [FBI disrupts the Dispossessor ransomware operation, seizes servers](https:\u002F\u002Fbleepingcomputer.com\u002Fnews\u002Fsecurity\u002Ffbi-disrupts-the-dispossessor-ransomware-operation-seizes-servers)\n- [Ongoing Targeted Campaign Against US Law Firms | Google Cloud Blog](https:\u002F\u002Fcloud.google.com\u002Fblog\u002Ftopics\u002Fthreat-intelligence\u002Ftargeted-campaign-us-law-firms)\n- [INC Ransom's Law Firm Extortion: %58 Paid?](https:\u002F\u002Fsocradar.io\u002Fblog\u002Finc-ransom-law-firm-extortion)\n- [Silent Ransom Group Hacked Greenberg Traurig; Who notifies the 126k Affected? (1)](https:\u002F\u002Fdatabreaches.net\u002F2026\u002F09\u002F14\u002Fsilent-ransom-group-hacked-greenberg-traurig-who-notifies-the-126k-affected)\n- [Conti ransomware gang member sentenced to 4 years in prison](https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fconti-ransomware-gang-member-sentenced-to-four-years-in-prison)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fsilent-ransom-group-leaks-data-from-64-law-firms-exposing-tens-of-thousands-of-s.png?v=0c6f6f75f0",{"iocs":19,"actors":23,"malware":50,"targets":54,"timeline":61,"industries":77},[20],{"type":21,"value":22},"domain","business-data-leaks[.]com",[24,28,34,37,41,46],{"url":25,"name":26,"slug":26,"type":15,"origin":27,"motivation":27},"\u002Fthreat-groups\u002Fbianlian","bianlian",null,{"url":29,"name":10,"slug":30,"type":31,"origin":32,"motivation":33},"\u002Fthreat-groups\u002Fsilent-ransom-group","silent-ransom-group","cybercrime","Russia (likely, per CrowdStrike)","financial",{"url":35,"name":36,"slug":36,"type":15,"origin":27,"motivation":27},"\u002Fthreat-groups\u002Fdispossessor","dispossessor",{"url":38,"name":39,"slug":40,"type":15,"origin":27,"motivation":33},"\u002Fthreat-groups\u002Finc-ransom","INC Ransom","inc-ransom",{"url":42,"name":43,"slug":44,"type":15,"origin":45,"motivation":33},"\u002Fthreat-groups\u002Fconti","Conti","conti","Russia",{"url":47,"name":48,"slug":49,"type":15,"origin":27,"motivation":33},"\u002Fthreat-groups\u002Fsicarii","Sicarii","sicarii",[51,53],{"name":52},"Dispossessor Ransomware",{"name":48},[55,58],{"name":11,"sector":56,"status":57,"geography":27},"legal","claimed",{"name":59,"sector":56,"status":60,"geography":27},"Greenberg Traurig","confirmed",[62,66,70,74],{"date":63,"event":64,"description":65},"2025-08-21","Data breach reported","DataBreaches reported data breach for Troutman Pepper Locke",{"date":67,"event":68,"description":69},"2026-03","Campaign","INC Ransom encryption streak against US law firms",{"date":71,"event":72,"description":73},"2026-04","Leak","SRG leak site listed 38 law firms",{"date":75,"event":72,"description":76},"2026-06-29","48 law firms leaked by June 29",[78],{"url":79,"name":80,"slug":56},"\u002Findustries\u002Flegal","Legal","ransomware_incident","2026-09-21T17:04:06.647891+00:00","2026-10-16T12:28:17.860933+00:00",{"articles":85},[86,96,108,118],{"slug":87,"title":88,"summary":89,"tags":90,"hero_image_url":94,"story_type":81,"created_at":95},"satanlock-ransomware-group-shuts-down-after-six-months-claims-67-victims","SatanLock ransomware group shuts down after six months, claims 67 victims","SatanLock, a double-extortion ransomware group, has ceased operations after roughly six months, claiming 67 compromised organizations and leaking stolen data.",[15,91,92,13,93],"SatanLock","sanlockv2","double extortion","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fsatanlock-ransomware-group-shuts-down-after-six-months-claims-67-victims.png?v=99e2fb1938","2026-08-26T12:10:42.22722+00:00",{"slug":97,"title":98,"summary":99,"tags":100,"hero_image_url":106,"story_type":81,"created_at":107},"lockfile-ransomware-hijacks-windows-domains-via-petitpotam-ntlm-relay","LockFile Ransomware Hijacks Windows Domains via PetitPotam NTLM Relay","LockFile ransomware gang is leveraging the PetitPotam NTLM relay attack (CVE-2021-36942) to take over Windows domain controllers, with initial access gained through ProxyShell on Exchange servers.",[15,101,102,103,104,105],"PetitPotam","NTLM relay","ProxyShell","LockFile","CVE-2021-36942","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Flockfile-ransomware-hijacks-windows-domains-via-petitpotam-ntlm-relay.png?v=3ebd8c1c3f","2026-09-26T07:06:42.867972+00:00",{"slug":109,"title":110,"summary":111,"tags":112,"hero_image_url":116,"story_type":81,"created_at":117},"dark-project-ransomware-group-hits-brainhunter-companies-llc-and-brainhunter-sys","Dark Project ransomware group hits Brainhunter Companies LLC and Brainhunter Systems Ltd.","Dark Project, a ransomware group first seen in April 2026, has published Brainhunter Companies LLC and Brainhunter Systems Ltd. as its latest victims, bringing its total to 19 known targets with 9 active extortion links on ransomware.live.",[113,114,15,93,115],"Dark Project","Brainhunter","ransomware.live","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fdark-project-ransomware-group-hits-brainhunter-companies-llc-and-brainhunter-sys.png?v=d6c0e0a4ac","2026-09-21T07:02:16.98855+00:00",{"slug":119,"title":120,"summary":121,"tags":122,"hero_image_url":127,"story_type":81,"created_at":128},"coinbasecartel-ransomware-group-claims-190-victims-across-17-sectors","CoinbaseCartel Ransomware Group Claims 190 Victims Across 17 Sectors","CoinbaseCartel, a data-exfiltration ransomware group that debuted in September 2025, has accumulated 190 claimed victims across 17 industry verticals, with recent hits on Turner & Townsend, Serruya PE, Sweet Water Holdings, Hitachi High-Tech, CEN\u002FCenelec, MIM Fertility, M.B. Kahn, Xs Cad, Accesso, Caterpillar, Colliers, PanasonicAero, Axiom Global, Demand.io, and Cambridge Mobile Telematics.",[15,123,124,125,126],"data-exfiltration","coinbasecartel","dark-web","extortion","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fcoinbasecartel-ransomware-group-claims-190-victims-across-17-sectors.png?v=ad90ff5f5f","2026-09-18T17:05:03.820479+00:00"]