[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fXFuOUXEI48cPGrATGqxiSXMVFpWuD1KB1RacQE3zKQ4":3,"$fVBflDGmhBufLq9kYPXQnglbaRfbXqgLxKrUkcvzL2fs":85},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":16,"hero_image_url":17,"structured":18,"story_type":82,"created_at":83,"updated_at":84,"published_at":34},"silent-ransom-group-leaks-data-from-64-law-firms-exposing-tens-of-thousands-of-s","Silent Ransom Group Claims Troutman Pepper Locke Leak as Its Site Lists 64 Law Firms","SRG says it leaked data from a second attack on the firm. Troutman Pepper Locke says no unauthorised party gained access to its environment.","Silent Ransom Group's leak site listed 64 law firms in August 2026, according to DataBreaches.net, and the group claims it leaked data taken from Troutman Pepper Locke. The firm says an employee was targeted by social engineering and sent documents to an unauthorised party, but that no one gained access to its environment.",[10,11,12,13,14,15],"Silent Ransom Group","Troutman Pepper Locke","law firm","data leak","SSN","ransomware","# Silent Ransom Group Claims Troutman Pepper Locke Leak as Its Site Lists 64 Law Firms\n\n*SRG says it leaked data from a second attack on the firm. Troutman Pepper Locke says no unauthorised party gained access to its environment.*\n\n**Tags:** `Silent Ransom Group` `Troutman Pepper Locke` `law firm` `data leak` `extortion`\n\n> Silent Ransom Group's leak site listed 64 law firms in August 2026, according to DataBreaches.net, and the group claims it leaked data taken from Troutman Pepper Locke. The firm says an employee was targeted by social engineering and sent documents to an unauthorised party, but that no one gained access to its environment.\n\n---\n\n## The claim against Troutman Pepper Locke\n\nOn 21 August 2026 DataBreaches.net reported that Silent Ransom Group's (SRG) leak site listed 64 law firms, up from 38 in April and 48 by 29 June. These are the group's own listings and have not been independently verified.\n\nSRG claimed responsibility for an attack on Troutman Pepper Locke and told DataBreaches.net that it had accessed the firm remotely on 7 August 2026, that the firm refused to pay, and that it then leaked the data. The group also claims it was behind an April 2025 incident at the firm involving a physical intrusion. In a July 2025 notification to the New Hampshire Attorney General, the firm said that incident was confined to a physical intrusion involving a single laptop and that there was no evidence of unauthorised remote access to its systems. SRG disputes that description.\n\nDataBreaches.net said its preliminary inspection of the leaked files found names, postal addresses and full Social Security numbers in more than 64,000 records, some of which may be duplicates, along with files labelled \"privileged and confidential\" and confidential mediation files. That count is DataBreaches.net's own and has not been confirmed by the firm.\n\n## The firm's response\n\nTroutman Pepper Locke did not reply to DataBreaches.net before its report was published. In a later statement reported by The Atlanta Journal-Constitution on 26 August, the firm said an employee was \"targeted by a social engineering attack\", interacted with communications that appeared legitimate, and mistakenly sent documents to an unauthorised party. It said this was \"an isolated incident and did not impact our operations\" and that \"at no point did an unauthorized party gain access to our environment.\" The firm did not address SRG's claims or the number of people affected.\n\nA proposed class action filed in federal court in Atlanta alleges that names, dates of birth, Social Security numbers and addresses were exposed and puts the number of people at risk at about 37,000. These are allegations in the complaint and have not been tested in court.\n\n## How SRG operates\n\nGoogle Threat Intelligence Group tracks the group as UNC3753, also known as Luna Moth, Chatty Spider and Silent Ransom Group, and says it has been active since at least March 2022. In a June 2026 report, Google said the group starts with invoice-themed emails that contain no links or attachments, then calls employees while posing as the internal IT helpdesk or security team. Victims are talked into starting screen-sharing sessions or installing legitimate remote management tools such as AnyDesk, Bomgar or Zoho Assist, and data is exfiltrated with tools such as WinSCP or Rclone.\n\nGoogle said the group deployed LockBit Black in 2022 but has since prioritised extortion without encryption, and that its leak site is LEAKEDDATA at business-data-leaks[.]com. Google also reported cases of people posing as IT technicians entering offices to try to copy data from an endpoint to USB storage, and assessed that these physical intrusions are likely associated with UNC3753.\n\n## Key points\n\n- DataBreaches.net reported on 21 August 2026 that SRG's leak site listed 64 law firms, up from 38 in April and 48 by 29 June. These are the group's own listings.\n- SRG claims it attacked Troutman Pepper Locke remotely on 7 August 2026 and leaked the data after the firm refused to pay.\n- The firm says an employee sent documents to an unauthorised party after a social engineering attack, and that no unauthorised party gained access to its environment.\n- DataBreaches.net found full Social Security numbers in more than 64,000 records in the leaked files; a proposed class action alleges about 37,000 people are at risk.\n- Google tracks SRG as UNC3753 and says it relies on callback phishing and legitimate remote access tools, not custom malware, and now focuses on data theft without encryption.\n\n## Further reading & sources\n\n- [Troutman Pepper Locke Silent as Threat Actors Leak Client Data, Tens of Thousands of SSNs](https:\u002F\u002Fdatabreaches.net\u002F2026\u002F08\u002F21\u002Ftroutman-pepper-locke-silent-as-threat-actors-leak-client-data-tens-of-thousands-of-ssns) — DataBreaches\n- [Large Atlanta law firm hit with data breach and associated lawsuit](https:\u002F\u002Fwww.ajc.com\u002Fnews\u002F2026\u002F08\u002Flarge-atlanta-law-firm-hit-with-data-breach-and-associated-lawsuit\u002F) — The Atlanta Journal-Constitution\n- [Ongoing Targeted Campaign Against US Law Firms](https:\u002F\u002Fcloud.google.com\u002Fblog\u002Ftopics\u002Fthreat-intelligence\u002Ftargeted-campaign-us-law-firms) — Google Cloud Blog","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fsilent-ransom-group-leaks-data-from-64-law-firms-exposing-tens-of-thousands-of-s.png?v=0c6f6f75f0",{"iocs":19,"actors":23,"malware":35,"targets":46,"timeline":50,"industries":70,"techniques":74,"technologies":79},[20],{"type":21,"value":22},"domain","business-data-leaks[.]com",[24,30],{"url":25,"name":10,"slug":26,"type":27,"origin":28,"motivation":29},"\u002Fthreat-groups\u002Fsilent-ransom-group","silent-ransom-group","cybercrime","Russia (likely, per CrowdStrike)","financial",{"url":31,"name":32,"slug":33,"type":15,"origin":34,"motivation":29},"\u002Fthreat-groups\u002Flockbit","LockBit","lockbit",null,[36,38,40,42,44],{"name":37},"WinSCP",{"name":39},"Rclone",{"name":41},"Zoho Assist",{"name":43},"AnyDesk",{"name":45},"Bomgar",[47],{"name":11,"sector":48,"status":49,"geography":34},"legal","claimed",[51,55,59,63,67],{"date":52,"event":53,"description":54},"2025-08-21","Data breach reported","DataBreaches reported data breach for Troutman Pepper Locke",{"date":56,"event":57,"description":58},"2026-03","Campaign","INC Ransom encryption streak against US law firms",{"date":60,"event":61,"description":62},"2026-04","Leak","SRG leak site listed 38 law firms",{"date":64,"event":65,"description":66},"2026-06-15","Claim","The Gentlemen claim Mackay Sugar on Tor leak site",{"date":68,"event":61,"description":69},"2026-06-29","48 law firms leaked by June 29",[71],{"url":72,"name":73,"slug":48},"\u002Findustries\u002Flegal","Legal",[75],{"id":76,"url":77,"name":78},"T1219","\u002Fmitre-attack\u002Ftechniques\u002FT1219","Remote Access Tools",[80],{"vendor":43,"product":81},"RMM","ransomware_incident","2026-09-21T17:04:06.647891+00:00","2026-10-16T12:28:17.860933+00:00",{"articles":86},[87,98,110,120],{"slug":88,"title":89,"summary":90,"tags":91,"hero_image_url":96,"story_type":82,"created_at":97},"coinbasecartel-ransomware-group-claims-190-victims-across-17-sectors","CoinbaseCartel Extortion Group Has Listed More Than 200 Claimed Victims","CoinbaseCartel, a data-theft extortion group that appeared in September 2025, has 207 claimed victims on ransomware.live, 76 of them in the US; researchers link its access mainly to reused infostealer credentials, while a suggested tie to the Scattered LAPSUS$ Hunters ecosystem remains unconfirmed.",[15,92,93,94,95],"data-exfiltration","coinbasecartel","dark-web","extortion","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fcoinbasecartel-ransomware-group-claims-190-victims-across-17-sectors.png?v=ad90ff5f5f","2026-09-18T17:05:03.820479+00:00",{"slug":99,"title":100,"summary":101,"tags":102,"hero_image_url":108,"story_type":82,"created_at":109},"storm-1175-deploys-new-stormencryptor-ransomware-via-n-central-ncm-auth-bypass","Storm-1175 deploys new StormEncryptor ransomware, likely via N-central auth bypass","Microsoft Threat Intelligence has observed Storm-1175, a financially motivated actor it previously linked to Medusa ransomware, deploying a new C++ ransomware strain called StormEncryptor, with exploitation of the N-able N-central authentication bypass CVE-2026-18577 the likely route in.",[103,104,105,106,107],"StormEncryptor","Storm-1175","N-central NCM","CVE-2026-18577","Medusa","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fstorm-1175-deploys-new-stormencryptor-ransomware-via-n-central-ncm-auth-bypass.png?v=316922394f","2026-09-26T07:12:34.821288+00:00",{"slug":111,"title":112,"summary":113,"tags":114,"hero_image_url":118,"story_type":82,"created_at":119},"stormencryptor-ransomware-deployed-via-n-central-auth-bypass-cve-2026-18577","N-central auth bypass CVE-2026-18577 exploited; Microsoft links attacks to StormEncryptor actor","Attackers exploited CVE-2026-18577, an incomplete patch for the N-able N-central authentication bypass CVE-2026-18556, to take over N-central servers and reach managed endpoints. Microsoft believes the actor may be Storm-1175, which has switched from Medusa to a new ransomware strain, StormEncryptor.",[115,106,103,116,117],"N-able N-central","Ransomware","MSP","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fstormencryptor-ransomware-deployed-via-n-central-auth-bypass-cve-2026-18577.png?v=80dc7c8067","2026-09-24T07:05:56.501709+00:00",{"slug":121,"title":122,"summary":123,"tags":124,"hero_image_url":129,"story_type":82,"created_at":130},"dragonforce-ransomware-hits-saudi-chemical-manufacturer","DragonForce Ransomware Claims Attack on Saudi Chemical Manufacturer","DragonForce has claimed an attack on a Saudi Arabian chemical manufacturer, listed in AhnLab ASEC's dark web roundup of 16 July 2026. The claim comes from the group itself and has not been independently confirmed. Industry trackers count DragonForce among the most active ransomware operations of Q2 2026, though their victim totals differ.",[125,116,126,127,128],"DragonForce","Saudi Arabia","Chemical Manufacturing","ASEC","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fdragonforce-ransomware-hits-saudi-chemical-manufacturer.png?v=789ad783bf","2026-09-19T12:09:53.129912+00:00"]