Aroeira Salles Advogados listed on direwolf leak site

• Ransomware group: direwolf
• Country: Brazil
• Sector: Professional Services
• Announcement date: August 25, 2025

Aroeira Salles Advogados targeted by direwolf

The law firm Aroeira Salles Advogados has been listed on a leak site by the threat actor known as direwolf. According to the announcement made by the group, the firm's systems have been compromised, leading to a significant data breach. This incident follows a pattern often seen in modern cyberattacks where threat actors use leak sites to pressure organizations by threatening to release sensitive information to the public.

The threat actor, identified as direwolf, claims to have obtained a substantial amount of data from the institution's systems. Specifically, the group alleges that they have successfully exfiltrated 460 GB of data. The announcement was made on August 25, 2025, which also coincides with the date the group claims the attack occurred. While the group has provided a timeline for the potential release of the stolen information, public information regarding the specific capabilities and background of the direwolf group remains limited.

Details of the claimed data theft

The threat actor has provided a specific timeline for the potential disclosure of the stolen information, stating that all documents are expected to be published by September 10, 2025. The leak announcement claims to contain a wide variety of sensitive materials that could impact both the firm and its clients. The types of data allegedly involved in this breach include:

• Legal documents
• Customer information
• Claims history
• Confidentiality agreements
• User documents
• Employee documents
• Court documents

In many ransomware scenarios, threat actors employ a strategy known as double extortion. In this model, attackers do not just encrypt an organization's files to disrupt operations; they also steal sensitive data to use as leverage. If the victim refuses to pay a ransom, the attackers threaten to leak the stolen information on public forums or leak sites to cause reputational, legal, and financial damage.

Potential impact and risks

Such breaches targeting law firms may lead to the violation of client confidentiality and the exposure of sensitive legal proceedings. Because the data allegedly contains court documents and confidentiality agreements, the integrity of ongoing or past legal matters could be compromised. Furthermore, the presence of employee and customer information in the leaked data could increase the likelihood of affected individuals being targeted by identity theft or spear-phishing attacks.

As the institution operates in Brazil, the incident may result in legal and administrative sanctions under the LGPD (General Data Protection Law). The exposure of such diverse datasets poses a significant risk to the privacy of individuals involved in the firm's legal matters. Additionally, this incident may pose a secondary supply chain risk for other organizations represented by the law firm, as the breach of a legal service provider can create a ripple effect through its entire client base.

Defensive considerations for professional services

Organizations in the professional services sector, particularly law firms handling sensitive client data, can take several steps to mitigate the risks of such attacks. Implementing robust access controls and multi-factor authentication (MFA) is a fundamental step in preventing unauthorized access to sensitive systems. Furthermore, maintaining rigorous data encryption standards for data at rest and in transit can help protect information even if a perimeter is breached.

Regular security awareness training is also vital to help employees recognize and avoid spear-phishing attempts, which are often used as an initial entry point for ransomware groups. Finally, maintaining comprehensive, offline backups and a well-tested incident response plan can significantly reduce the impact of a successful breach, allowing for faster recovery and more controlled responses to data exfiltration threats.