Fong Ilagan, LLP listed on Genesis ransomware leak site

• Ransomware group: Genesis
• Country: United States
• Sector: Professional Services
• Announcement date: February 17, 2026

Genesis claims data breach at Fong Ilagan, LLP

The threat actor known as Genesis has listed the professional services firm Fong Ilagan, LLP on its leak site. According to the announcement made on February 17, 2026, the group claims to have exfiltrated approximately 100 GB of data from the organization's systems.

This incident follows a common pattern observed in modern ransomware operations, often referred to as double extortion. In these scenarios, threat actors do not merely encrypt an organization's files to disrupt operations; they also focus on stealing sensitive information. By threatening to leak this data on a public leak site, the attackers aim to exert maximum pressure on the victim to fulfill ransom demands, leveraging the threat of reputational damage and legal scrutiny.

The Genesis group has claimed to have compromised data belonging to Fong Ilagan, LLP and has listed the institution on its leak site. It is alleged that 100 GB of data was exfiltrated from the company's file servers. Information regarding the specific identity and operational details of this group remains limited.

Claimed data contents and affected information

The announcement made by the Genesis group claims that the stolen data is highly sensitive and contains a wide variety of information. The group asserts that the exfiltrated content includes various types of personal, legal, and corporate records. The specific categories of data mentioned in the leak site announcement include:

• Client personal data
• Client medical records
• Client criminal records
• Client financial data
• Litigation files
• Confidential settlement agreements
• Non-disclosure agreements
• Company financial data
• Personal folders of network users

The breadth of this alleged data set suggests a significant breach of confidentiality. When attackers target file servers, they often seek out high-value directories that contain the core intellectual property or sensitive client information of a firm. The presence of personal folders belonging to network users further indicates that the breach may have extended beyond official corporate repositories into individual user environments.

Potential consequences and organizational risks

The alleged exfiltration of sensitive client and financial data suggests that affected individuals may face significant risks of identity theft and fraud. Because the data is said to include medical and criminal records alongside financial information, the potential for misuse by malicious actors is high. Furthermore, the leaked data could potentially be utilized in secondary attacks or targeted phishing campaigns against the affected parties, as attackers often use stolen information to craft highly convincing social engineering lures.

Given the nature of the firm, the exposure of attorney-client privileged information could lead to significant legal and reputational consequences for the institution. As a United States-based entity, the firm may be subject to various state-level data breach notification laws and privacy regulations. Such regulations typically require organizations to notify affected individuals and relevant authorities when sensitive personal information has been compromised.

For organizations operating in the professional services sector, these types of incidents highlight the critical importance of robust cybersecurity frameworks. To mitigate such risks, organizations often implement defensive measures such as multi-factor authentication (MFA), rigorous access controls to limit data exposure, and continuous monitoring of network traffic to detect unauthorized data exfiltration. Additionally, maintaining regular, offline backups and implementing data loss prevention (DLP) strategies are common industry practices used to defend against the evolving tactics of ransomware groups like Genesis.