Dreyfuss Williams & Associates Co., LPA targeted by Knight ransomware group

• Ransomware group: Knight
• Country: United States
• Sector: Professional Services
• Announcement date: November 20, 2023

The ransomware group known as Knight has officially claimed responsibility for a cyberattack targeting Dreyfuss Williams & Associates Co., LPA. According to an announcement made on the group's leak site on November 20, 2023, the threat actors claim to have successfully exfiltrated a massive volume of data from the organization's network.

Details of the alleged attack

The Knight group has announced the addition of Dreyfuss Williams & Associates Co., LPA to their public leak site. The threat actor claims to have downloaded over 300 GB of data from the institution's network, which reportedly includes more than 100,000 documents. This type of incident is characteristic of double extortion tactics, a common method used by modern ransomware groups. In these scenarios, attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive information to use as leverage during negotiations.

The group has stated that if ransom negotiations are not initiated, they will proceed to publish the stolen data publicly. This pressure tactic is designed to force organizations into compliance by threatening their reputation and the privacy of their clients. While the group has listed the firm on their site, the specific details regarding a ransom demand were not provided in the announcement.

Alleged compromised data

The data allegedly stolen during this breach is highly sensitive, potentially exposing the private information of numerous individuals. According to the claims made by the Knight group, the stolen files include information belonging to US residents. The specific data types mentioned include:

• Social Security Numbers (SSN)
• Date of birth

The group provided a screenshot of the security check page of their leak site as part of their announcement. The presence of such sensitive identifiers, such as Social Security Numbers, significantly increases the risk of identity theft and targeted phishing attacks against the affected individuals.

About Dreyfuss Williams & Associates Co., LPA

Dreyfuss Williams & Associates Co., LPA is a law firm based in Ohio, United States. The company provides legal consulting and representation services in various legal matters.

Implications and organizational response

This alleged breach may pose a significant risk due to the potential exposure of sensitive personal information. As the institution is based in the US, a potential data breach could lead to legal consequences under state-level privacy laws and federal regulations. The exposure of Social Security Numbers and dates of birth is particularly critical, as these are foundational elements used in identity verification and fraudulent activities.

For organizations in the professional services sector, such incidents highlight the necessity of robust cybersecurity frameworks. Organizations facing such threats often need to initiate an urgent digital forensic investigation to determine the accuracy and scope of the data involved. Such investigations are vital to understanding how the perimeter was breached and what specific systems were compromised.

Defensive measures for organizations typically include implementing multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular employee training to recognize phishing attempts. Furthermore, maintaining offline, encrypted backups is a standard industry practice to mitigate the impact of encryption-based ransomware. As public information regarding the Knight group remains limited, organizations must remain vigilant against their evolving tactics.