Gruel Mills Nims Pylman listed on Insomnia ransomware leak site

• Ransomware group: Insomnia
• Country: United States
• Sector: Professional Services
• Announcement date: February 7, 2026

The Insomnia ransomware group has listed the United States-based law firm Gruel Mills Nims Pylman on its dedicated leak site. According to the announcement posted on February 7, 2026, the threat actor claims to have compromised the organization's systems, potentially exposing sensitive information belonging to the firm's clients.

The claimed attack and event details

The threat actor known as Insomnia has published a listing on its platform claiming that the law firm Gruel Mills Nims Pylman was compromised on November 10, 2025. This announcement follows a common pattern observed in modern cyberattacks known as double extortion. In these scenarios, threat actors do not merely encrypt an organization's data to disrupt operations; they also exfiltrate sensitive information to use as leverage. The goal is to pressure the victim into paying a ransom by threatening to leak the stolen data publicly, which can lead to significant legal, regulatory, and reputational damage.

While the listing is a claim made by the ransomware group, the presence of such announcements on leak sites often indicates a high-pressure tactic used to maximize the impact of the extortion attempt. The group's announcement suggests that the breach was successful in obtaining a variety of documents that are highly sensitive in nature, particularly given the professional nature of the victim organization.

Data allegedly involved in the breach

The information provided by the Insomnia group suggests that the stolen data includes highly confidential legal and medical documentation. Based on the screenshots provided by the threat actor, the breach involves documents that contain sensitive personal details. The specific types of data mentioned in the claim include:

• Medical records
• Legal settlement documents
• Personally identifiable information

The inclusion of medical records and personally identifiable information (PII) is particularly critical, as these data types are highly valued on illicit markets and can be used for various malicious purposes. The presence of court settlement agreements further highlights the sensitive nature of the information allegedly held by the firm.

About Gruel Mills Nims Pylman

Gruel Mills Nims Pylman PLLC is a law firm based in Grand Rapids, specializing in personal injury cases. With 35 years of experience, they represent victims in matters such as vehicle accidents, sexual abuse, and medical malpractice.

Potential impact and industry implications

This alleged breach may pose significant risks to client privacy and the professional responsibilities of the law firm. As a law firm operating in the United States, the organization may face legal consequences under HIPAA and state-level data protection regulations, particularly given the sensitive medical information involved. The exposure of such data can lead to severe consequences for the clients, who could be targeted by identity theft or sophisticated phishing attacks using the stolen information.

Furthermore, given the firm's professional obligation to maintain strict client confidentiality, this incident could negatively impact the institution's reputation. For professional services firms, trust is a foundational element of their business model, and a breach of this nature can damage the relationship between the firm and its clients.

In general, organizations in the professional services sector can take several defensive steps to mitigate the risks of such attacks. Implementing robust encryption for data at rest and in transit, enforcing multi-factor authentication (MFA) across all systems, and maintaining strict access controls are essential practices. Additionally, regular security awareness training can help employees recognize phishing attempts, which are often the initial entry point for ransomware actors. Organizations should also maintain comprehensive, offline backups to ensure business continuity in the event of a successful encryption attack.