Dunn and Dunn listed on insomnia ransomware leak site

• Ransomware group: insomnia
• Country: United States
• Sector: Professional Services
• Announcement date: February 7, 2026

Dunn and Dunn targeted by insomnia ransomware group

The threat actor group known as insomnia has listed the Boston-based law firm Dunn and Dunn on its dedicated leak site. According to the announcement posted on February 7, 2026, the group claims to have obtained data belonging to the organization. While the listing confirms the presence of the firm on the leak site, specific details regarding the total volume of stolen data and the specific ransom demand remain unknown.

Details of the claimed attack

The group insomnia alleges that the data breach occurred on January 8, 2026. The announcement indicates that the group has access to information related to the firm's operations. Currently, public information regarding the specific capabilities and background of the insomnia group remains limited. In modern cyberattack scenarios, ransomware groups often utilize leak sites to pressure victims by threatening to release sensitive information if demands are not met. This tactic is frequently associated with double-extortion strategies, where attackers not only encrypt systems but also steal data to use as leverage during negotiations.

Data types involved in the leak

Based on screenshots provided by the threat actor, the leaked information appears to be highly sensitive. The samples displayed in the announcement suggest that the breach involves a variety of critical documents. The following data types have been identified as being part of the alleged leak:

• Patient medical records
• Laboratory results
• Court documents
• Personally identifiable information

The presence of such diverse documentation suggests a significant breach of confidentiality regarding both legal proceedings and private medical histories.

About Dunn and Dunn

Dunn and Dunn is a law firm based in Boston that has been in operation since 1928. The firm specializes in providing legal counsel and representation to healthcare professionals. Their legal expertise covers several critical areas, including medical malpractice defense, long-term care defense, and general liability defense. Given their specialized focus on the intersection of law and healthcare, the firm handles a vast amount of sensitive information related to medical practitioners and their patients.

Implications and industry considerations

The nature of the data allegedly stolen carries significant implications for the affected parties. Because Dunn and Dunn specializes in healthcare law, the sensitivity of the leaked information is particularly high. The disclosure of medical records and laboratory results can lead to substantial risks for patients, including potential identity theft and various forms of fraud. Furthermore, as the firm operates within the United States, such a breach may trigger complex legal repercussions and mandatory compliance processes under the Health Insurance Portability and Accountability Act (HIPAA) regulations.

Beyond regulatory compliance, the breach may have a profound impact on the firm's professional reputation, specifically regarding the sanctity of attorney-client privilege. When sensitive legal and medical data is exposed, the trust between the firm and its clients is often compromised. For organizations operating in the professional services and healthcare law sectors, maintaining robust cybersecurity defenses is essential to protect client confidentiality. Common defensive measures include implementing multi-factor authentication, maintaining strict access controls, and conducting regular security audits to ensure compliance with industry-specific regulations and to mitigate the risk of data exfiltration.