Dispossessor claims data breach against proskauer.com

• Ransomware group: Dispossessor
• Country: United States
• Sector: Professional Services
• Announcement date: April 19, 2024

Dispossessor claims proskauer.com has been targeted

The ransomware group known as Dispossessor has announced the listing of proskauer.com on its leak site. In a post published on April 19, 2024, the group stated that the organization has been added to their list of victims. This announcement follows a pattern seen in modern cyberattacks where threat actors use public leak sites to pressure organizations by claiming they have successfully exfiltrated sensitive information.

Ransomware groups often utilize these platforms as a method of double extortion. In such scenarios, attackers not only encrypt an organization's internal systems to disrupt operations but also steal sensitive data to use as leverage. By threatening to release this data publicly, the attackers aim to maximize the pressure on the victim to fulfill ransom demands. While the presence of a name on a leak site does not confirm a successful breach, it indicates a targeted claim by the threat actor.

Details of the alleged incident

According to the claim made by the Dispossessor group, the organization's data has been compromised. The group provided a download link in their announcement, asserting that the data in question was uploaded on January 15, 2022. This discrepancy between the claimed upload date and the announcement date suggests that the group may have held the data for a significant period before making it public.

Regarding the specific contents of the alleged leak, no specific details or file lists regarding the content of the allegedly leaked data have been provided. The listing does not specify the volume of data or the exact nature of the files involved.

Organization profile

Proskauer Rose LLP is an international law firm headquartered in New York, specializing in areas such as corporate law, litigation, and tax law.

Analysis and implications for the professional services sector

This claim made by the Dispossessor group may raise concerns regarding the data security processes of the organization. If the allegations are accurate, the nature of the professional services sector suggests that sensitive client or commercial data could be at risk of exposure. Such an incident may damage the organization's reputation and potentially trigger legal processes under relevant data protection regulations.

The group, which emerged in late 2023 and has previously targeted law enforcement infrastructure, presents a specific set of risks. Given the group's history, it is assessed that such leaks could lead to secondary risks such as identity theft or targeted phishing attacks. Because public information about this group is limited, organizations must remain vigilant against the evolving tactics used by such actors.

For organizations operating within the professional services sector, maintaining robust defensive postures is critical. Common defensive steps include implementing multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular employee training to recognize phishing attempts. Furthermore, organizations often rely on comprehensive data encryption and network segmentation to limit the potential impact of a breach and protect sensitive client information from unauthorized exfiltration.