CMS Legal Services EEIG targeted by crypto24 ransomware group

• Ransomware group: crypto24
• Country: Germany
• Sector: Professional Services
• Announcement date: August 16, 2025

Crypto24 claims to possess confidential data from CMS Legal Services EEIG

The ransomware group known as crypto24 has issued an announcement on its leak site claiming to be in possession of confidential data belonging to CMS Legal Services EEIG. According to the threat actor, the organization has been compromised, and the group has threatened to release the stolen information to the public. This announcement marks a significant claim of a data breach targeting a major player in the professional services sector.

Details of the alleged data breach

The threat actor claims to have successfully acquired the organization's data and has stated that the full dataset will be released publicly. While the group has made these claims, no screenshots were provided in the announcement to verify the content of the stolen files. The post lists several specific categories of information that the group alleges are included in the breach.

The categories of information claimed to be part of the leak include:

• Government and infrastructure project files
• Multinational corporation contracts
• Tax authority system access records
• Financial and legal documents
• Payroll and personnel information

The group has not provided information regarding the total size of the data, the specific number of files involved, or the amount of ransom demanded for the non-disclosure of the data.

About CMS Legal Services EEIG

CMS is an international law firm specializing in corporate law and tax advisory services, operating globally. It provides a wide range of legal services to multinational corporations, financial institutions, and public sector entities.

Potential impact and security implications

The leakage of such sensitive data may cause potential reputational damage to the firm within the international legal sector. Given the nature of the data involved, the incident could lead to high-risk compliance issues under the General Data Protection Regulation (GDPR). The exposure of sensitive contracts and personnel details may facilitate targeted phishing or secondary extortion attempts against the firm or its clients.

This situation could potentially impact the organization's data privacy standing. It is important to note that publicly available information regarding the crypto24 group remains limited. In the broader context of cyber threats, ransomware groups often utilize double extortion tactics, where they not only encrypt an organization's systems but also threaten to leak sensitive data to pressure the victim into paying a ransom. This method increases the pressure on organizations to comply with demands to avoid public exposure of proprietary or private information.

For organizations operating in the professional services and legal sectors, maintaining robust cybersecurity postures is critical. Common defensive steps often include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training to mitigate the risk of phishing. Furthermore, strict access controls and monitoring of system logs can help detect unauthorized access to sensitive files, such as those involving government projects or multinational contracts, before a large-scale exfiltration can occur.