EvansPetree listed on Storm ransomware leak site

• Ransomware group: Storm
• Country: United States
• Announcement date: August 7, 2026

Storm ransomware group claims attack on EvansPetree

The ransomware group known as Storm has listed the United States-based law firm EvansPetree on its dedicated leak site. The group claims to have successfully exfiltrated a significant amount of data belonging to the organization, marking a potential breach of sensitive legal information.

According to the announcement made by the threat actors, the attack against EvansPetree was carried out on August 5, 2026. The listing, which was officially posted on the group's leak site on August 7, 2026, remains active. The Storm group asserts that they have gained unauthorized access to the organization's systems, allowing them to claim possession of a vast quantity of files.

The scale of the alleged theft is substantial. The group claims to have obtained approximately 391 GB of data. This data volume is comprised of a specific count of 209,178 files. While the group has published the listing, they have not specified the exact nature of the leaked data. However, given the professional nature of the target, it is assessed that the stolen information may include client information, litigation files, and sensitive corporate correspondence.

Organization profile

Evans Petree is a law firm with over 100 years of experience. The firm specializes in dispute resolution and litigation. They provide legal representation services to their clients across various legal arenas, including mediation, arbitration, and court proceedings.

Analysis and potential impact

This incident may present a significant risk due to the potential exposure of confidential client information within the legal sector. If the stolen data is eventually published by the threat actors, it is likely that clients could be exposed to identity theft or targeted phishing attacks. Such attacks often leverage the sensitive details found in legal documents to gain the trust of victims.

Because the organization operates within the United States, the incident may lead to legal repercussions. These could stem from state-level data protection laws and the professional confidentiality obligations inherent to the legal profession. The exposure of such sensitive material often triggers mandatory notification requirements to ensure that affected parties are aware of the potential risks to their privacy.

Regarding the threat actor, information about the Storm group remains limited. Based on the patterns observed in such incidents, it is assessed that the group may be employing double-extortion tactics. In a double-extortion scenario, attackers do not merely encrypt the victim's data to demand a ransom for the decryption key; they also steal sensitive information and threaten to leak it publicly unless a second ransom is paid. This tactic increases the pressure on the victim, as the threat of data exposure remains even if the organization can restore systems from backups.

In the broader context of cybersecurity, ransomware leak sites serve as a platform for extortion, where groups post proof of theft to coerce organizations into paying. To defend against such threats, organizations typically implement multi-layered security strategies. These include robust backup solutions, strict access controls, and continuous monitoring of network traffic to detect unauthorized data exfiltration. For organizations in the legal sector, maintaining high standards of encryption and data handling is critical to upholding professional confidentiality and protecting client interests from sophisticated threat actors like Storm.