Baker Donelson listed on Redact ransomware leak site

• Ransomware group: Redact
• Country: United States
• Sector: Professional Services
• Announcement date: October 19, 2026

Redact claims data exfiltration from Baker Donelson

The threat actor known as Redact has listed the professional services firm Baker Donelson on its leak site. According to the announcement published on October 19, 2026, the group claims to have successfully exfiltrated a significant amount of data from the organization. This incident follows a pattern often seen in modern cyberattacks where threat actors utilize leak sites to pressure victims through the threat of public disclosure.

Ransomware groups frequently employ a tactic known as double extortion. In these scenarios, attackers do not just encrypt a victim's systems to disrupt operations; they also steal sensitive information before the encryption occurs. By threatening to release this stolen data on a public leak site, the attackers aim to increase the pressure on the victim to pay a ransom, leveraging the potential for reputational damage and legal consequences as leverage.

Details of the alleged breach

The announcement made by Redact provides specific metrics regarding the volume of the alleged theft. The group claims to have obtained a substantial amount of information, which they state consists of 355 GB of data. This data is reportedly comprised of 102,390 individual files. The claim was made on the same day as the reported attack, October 19, 2026.

While the group has provided the total volume and file count, no specific details regarding the nature of the alleged stolen data were provided. The listing does not specify the file formats or the specific categories of information contained within the 102,390 files. Consequently, the exact contents of the exfiltrated data remain unconfirmed by the source.

About Baker Donelson

Baker Donelson is a large U.S.-based law firm providing a wide range of legal consulting and representation services. The firm specializes in areas such as corporate law, litigation, and public policy. Given the specialized nature of their professional services, the firm handles a variety of complex legal matters for its clients.

Potential impact and industry implications

This incident may pose a risk to the confidentiality of client information and attorney-client privileged data held by Baker Donelson. Because the organization is a US-based entity, potential data breaches could lead to legal proceedings under state-level data protection laws and industry-specific regulations. The exposed data could be leveraged for secondary attacks, such as identity theft or targeted phishing campaigns.

For organizations operating within the professional services sector, such incidents highlight the critical importance of robust data protection strategies. Common defensive steps for organizations to mitigate these risks include implementing strict access controls, maintaining comprehensive logging and monitoring to detect unauthorized data movement, and ensuring regular, offline backups. Furthermore, organizations often focus on employee training to prevent initial access through phishing, which is a common entry vector for ransomware groups.

Information regarding the Redact group is limited, making it difficult to attribute the attack to a specific known threat actor profile or to predict their future movements. As a result of this claim, negative impacts on the firm's operational continuity and reputation may be observed. The potential for secondary exploitation of stolen data remains a significant concern for firms handling sensitive legal documentation.