Brown & Winters listed on dragonforce ransomware leak site

• Ransomware group: dragonforce
• Country: United States
• Sector: Professional Services
• Announcement date: June 23, 2025

The California-based law firm Brown & Winters has been listed on the leak site of the dragonforce ransomware group. According to an announcement made on June 23, 2025, the threat actor group claims to have compromised the firm's networks, leading to a significant data breach.

The claimed attack and data exfiltration

The dragonforce group posted a claim on their leak site on June 23, 2025, alleging that they successfully breached the networks of Brown & Winters. The group claims to have obtained 112.34 GB of data from the organization. While the specific file count and the exact ransom demand remain unknown, the group has signaled that the stolen information is at risk of being published or sold on the dark web.

In many modern ransomware attacks, threat actors employ a strategy known as double extortion. This method involves not only encrypting an organization's files to disrupt operations but also exfiltrating sensitive data before the encryption process begins. By threatening to leak the stolen information on a public leak site, attackers gain additional leverage to pressure the victim into paying a ransom. The use of leak sites serves as a public shaming mechanism, increasing the pressure on the target organization to comply with the attackers' demands.

The announcement regarding the Brown & Winters incident suggests that the threat actors are moving toward the publication phase of their operation. The group has indicated that the data may be made available to the public or sold to other malicious actors, which significantly increases the potential impact of the breach beyond mere operational disruption.

Data types involved in the breach

According to the claims made by the dragonforce group, the compromised information includes specific categories of sensitive data. The announcement specifies that the stolen data consists of:

• Customer data
• Email data

The loss of such information can have cascading effects on the privacy of the individuals and entities represented by the firm. When email correspondence is compromised, it often exposes internal discussions, strategic planning, and private communications that were intended to remain confidential.

About Brown & Winters

Brown & Winters is a law firm based in California that specializes in the fields of environmental law and environmental insurance. The firm provides essential legal counsel to a variety of clients, including public entities, ports, and local governments. Their professional services focus on matters regarding the remediation of contaminated sites and ensuring compliance with environmental regulations.

Implications and security considerations

The potential exposure of data belonging to Brown & Winters carries significant risks. Because the firm handles sensitive legal matters, the leak may pose a risk of exposing information protected by attorney-client privilege. Furthermore, since the firm provides services to public entities, the incident could potentially impact supply chain security, as the breach of a service provider can create vulnerabilities for the organizations they support.

Given that the firm is based in the United States, the incident may trigger various state-level data protection regulations and lead to potential legal consequences. Additionally, the stolen data, particularly customer information and email correspondence, could be leveraged by malicious actors for identity theft or targeted phishing campaigns. Such campaigns often use the context of legitimate business communications to trick individuals into revealing further credentials or transferring funds.

Regarding the threat actor, public information concerning the dragonforce group is limited. However, it is known that the group follows a model of providing infrastructure to affiliates, which allows various operators to conduct attacks using the group's established framework. To defend against such threats, organizations in the professional services sector often implement defensive measures such as multi-factor authentication, robust encryption for data at rest and in transit, and continuous monitoring of network traffic to detect unauthorized exfiltration attempts.