FLP Law Group LLP targeted in alleged data breach by CRPxO

• Ransomware group: CRPxO
• Country: United States
• Sector: Professional Services
• Announcement date: July 27, 2026

A significant data breach has been reported involving FLP Law Group LLP

On July 27, 2026, a threat actor group known as CRPxO announced on a leak site that it had allegedly targeted FLP Law Group LLP. The group claims to have successfully exfiltrated a substantial volume of data, totaling approximately 42.1 GB, from the organization's network. This announcement follows a pattern often seen in modern cyberattacks where threat actors use public leak sites to pressure victims into meeting specific demands.

Details of the alleged infiltration

According to the claims made by CRPxO, the group managed to infiltrate the internal network of the law firm. The attackers assert that they gained unauthorized access to critical internal systems, specifically targeting case management and document management platforms. By accessing these centralized repositories, the group claims it was able to harvest a vast amount of sensitive information belonging to the firm and its clients.

The group has threatened to publish the stolen information if their demands are not met. It is important to note that public information regarding the specific tactics, techniques, and procedures used by CRPxO remains limited in the public domain. This incident highlights the ongoing threat posed by ransomware groups that employ double extortion tactics, where data is not only encrypted but also stolen to increase leverage over the victim.

The scope of the alleged data theft

The data allegedly stolen by CRPxO is highly sensitive, encompassing a wide range of confidential information. The group claims to have accessed files that could significantly impact the privacy of both the firm's employees and its clients. The alleged contents of the breach include:

• Client case files
• Financial records
• Tax returns
• Employee personal data (SSN)
• Salary data
• Bar license credentials
• Internal communications

About FLP Law Group LLP

FLP Law Group LLP is a United States-based law firm. The organization specializes primarily in bankruptcy law and commercial debt management, providing legal services that often involve highly sensitive financial and personal documentation.

Potential implications and organizational risks

The alleged exfiltration of data from a legal practice like FLP Law Group LLP poses severe risks to client confidentiality and the fundamental principle of attorney-client privilege. Because the firm operates within the United States, this incident could lead to significant legal implications under various state laws and professional regulatory requirements governing legal practitioners.

The exposure of specific data points, such as employee Social Security Numbers (SSNs) and salary information, creates immediate risks for identity theft and makes individuals targets for highly personalized phishing attacks. Furthermore, the leak of case files and financial records creates secondary risks for the firm's clients, whose private legal and financial matters may be exposed to the public or other malicious actors.

The threat to publish this data carries the potential for massive reputational damage to the organization. In the professional services sector, trust is a primary commodity; a breach of this nature can undermine the confidence that clients place in a firm to protect their most sensitive information. To defend against such threats, organizations in the professional services sector often implement defensive measures such as multi-factor authentication, rigorous access controls for document management systems, and continuous monitoring of network traffic to detect unauthorized data exfiltration.