The claim against Troutman Pepper Locke
On 21 August 2026 DataBreaches.net reported that Silent Ransom Group's (SRG) leak site listed 64 law firms, up from 38 in April and 48 by 29 June. These are the group's own listings and have not been independently verified.
SRG claimed responsibility for an attack on Troutman Pepper Locke and told DataBreaches.net that it had accessed the firm remotely on 7 August 2026, that the firm refused to pay, and that it then leaked the data. The group also claims it was behind an April 2025 incident at the firm involving a physical intrusion. In a July 2025 notification to the New Hampshire Attorney General, the firm said that incident was confined to a physical intrusion involving a single laptop and that there was no evidence of unauthorised remote access to its systems. SRG disputes that description.
DataBreaches.net said its preliminary inspection of the leaked files found names, postal addresses and full Social Security numbers in more than 64,000 records, some of which may be duplicates, along with files labelled "privileged and confidential" and confidential mediation files. That count is DataBreaches.net's own and has not been confirmed by the firm.
The firm's response
Troutman Pepper Locke did not reply to DataBreaches.net before its report was published. In a later statement reported by The Atlanta Journal-Constitution on 26 August, the firm said an employee was "targeted by a social engineering attack", interacted with communications that appeared legitimate, and mistakenly sent documents to an unauthorised party. It said this was "an isolated incident and did not impact our operations" and that "at no point did an unauthorized party gain access to our environment." The firm did not address SRG's claims or the number of people affected.
A proposed class action filed in federal court in Atlanta alleges that names, dates of birth, Social Security numbers and addresses were exposed and puts the number of people at risk at about 37,000. These are allegations in the complaint and have not been tested in court.
How SRG operates
Google Threat Intelligence Group tracks the group as UNC3753, also known as Luna Moth, Chatty Spider and Silent Ransom Group, and says it has been active since at least March 2022. In a June 2026 report, Google said the group starts with invoice-themed emails that contain no links or attachments, then calls employees while posing as the internal IT helpdesk or security team. Victims are talked into starting screen-sharing sessions or installing legitimate remote management tools such as AnyDesk, Bomgar or Zoho Assist, and data is exfiltrated with tools such as WinSCP or Rclone.
Google said the group deployed LockBit Black in 2022 but has since prioritised extortion without encryption, and that its leak site is LEAKEDDATA at business-data-leaks[.]com. Google also reported cases of people posing as IT technicians entering offices to try to copy data from an endpoint to USB storage, and assessed that these physical intrusions are likely associated with UNC3753.
Key points
- DataBreaches.net reported on 21 August 2026 that SRG's leak site listed 64 law firms, up from 38 in April and 48 by 29 June. These are the group's own listings.
- SRG claims it attacked Troutman Pepper Locke remotely on 7 August 2026 and leaked the data after the firm refused to pay.
- The firm says an employee sent documents to an unauthorised party after a social engineering attack, and that no unauthorised party gained access to its environment.
- DataBreaches.net found full Social Security numbers in more than 64,000 records in the leaked files; a proposed class action alleges about 37,000 people are at risk.
- Google tracks SRG as UNC3753 and says it relies on callback phishing and legitimate remote access tools, not custom malware, and now focuses on data theft without encryption.
Further reading & sources
- Troutman Pepper Locke Silent as Threat Actors Leak Client Data, Tens of Thousands of SSNs — DataBreaches
- Large Atlanta law firm hit with data breach and associated lawsuit — The Atlanta Journal-Constitution
- Ongoing Targeted Campaign Against US Law Firms — Google Cloud Blog