Attorneykohm.com listed on VanHelsing ransomware leak site

• Ransomware group: VanHelsing
• Country: United States
• Sector: Professional Services
• Announcement date: March 31, 2025

VanHelsing claims data breach at attorneykohm.com

The threat actor known as VanHelsing has listed attorneykohm.com on its leak site, claiming to have obtained and leaked data belonging to the organization. This announcement, made on March 31, 2025, suggests that an unauthorized access to the institution's network infrastructure may have occurred. The group has provided screenshots of a file directory as evidence, which is alleged to have been obtained from the organization's systems.

Ransomware attack patterns often involve a process known as double extortion. In these scenarios, threat actors do not merely encrypt an organization's files to disrupt operations; they also exfiltrate sensitive information before the encryption process begins. The threat actors then threaten to publish this stolen data on a dedicated leak site if the ransom demand is not met. This tactic places immense pressure on organizations, as the exposure of confidential information can lead to severe legal, regulatory, and reputational consequences, regardless of whether the organization's systems are successfully restored from backups.

Details of the claimed data exposure

The evidence provided by the VanHelsing group includes screenshots displaying a file directory under a server named 'Prevail'. This directory contains various PDF and WPD files. The file names within this directory suggest the potential presence of sensitive client records or legal documentation. While the specific volume of data or the exact number of files taken has not been disclosed by the group, the nature of the files visible in the directory indicates a potential exposure of highly sensitive information.

Based on the claims made by the threat actor, the following types of data may have been affected:

• Client legal documents
• Personally identifiable information

The presence of such files on a leak site highlights the critical nature of data security for professional service providers. When sensitive documents are exfiltrated, the risk of secondary extortion increases, as attackers may attempt to contact the victims or their clients directly to demand payment to prevent the public release of the information.

About attorneykohm.com

The Law Offices of David Kohm is a law firm operating in the Dallas-Fort Worth and Arlington area for over 25 years. It provides legal representation services to its clients in areas such as personal injury and financial law.

Implications and industry risks

This incident indicates that a law firm is facing a potential exposure of sensitive client data. Given the nature of law firms, the leaked data may contain confidential client information, which could increase the risk of identity theft or fraud for the affected individuals. As a US-based entity, the organization may be subject to state-level data breach notification laws and professional confidentiality obligations. Furthermore, the publication of such data could damage the firm's reputation and lead to secondary extortion attempts. Information regarding this group is limited.

For organizations operating in the professional services sector, such incidents underscore the necessity of robust cybersecurity frameworks. Protecting sensitive client information requires a multi-layered defense strategy. Common defensive steps for organizations include implementing strict access controls to ensure that only authorized personnel can reach sensitive directories, such as the 'Prevail' server mentioned in this claim. Additionally, organizations often employ continuous monitoring of network traffic to detect unauthorized access or large-scale data exfiltration attempts.

Regular security audits, the enforcement of multi-factor authentication (MFA) across all remote access points, and comprehensive employee training on phishing awareness are also standard industry practices to mitigate these risks. Because law firms handle highly sensitive personal and financial data, they are frequent targets for sophisticated threat actors seeking to exploit the high value of their information for extortion purposes.