Gruenberg Kelly Della listed on dragonforce leak site following alleged data breach

• Ransomware group: dragonforce
• Country: United States
• Sector: Professional Services
• Announcement date: November 21, 2025

A data breach claim against Gruenberg Kelly Della

The threat actor known as dragonforce has published a leak announcement claiming to have compromised data belonging to the law firm Gruenberg Kelly Della. According to the announcement posted on a leak site on November 21, 2025, the group alleges that the firm is currently facing significant issues related to the leak of client data. The threat actor further claims that the firm has shut down its phone lines following the incident.

The group has indicated that they are prepared to release 123.58 GB of data unless representatives from the firm initiate negotiations. No information was provided regarding a specific ransom demand. This incident highlights the ongoing trend of ransomware groups targeting professional service providers to exert pressure through the threat of public data exposure.

Details of the alleged data theft

The announcement made by dragonforce claims that the compromised data includes sensitive information belonging to the firm's clients. The threat actor asserts that the stolen information consists of specific categories of data that could pose significant risks to the individuals involved if released publicly.

The listing claims the following types of data have been affected:

• Medical records
• Financial data

The exposure of such sensitive information can lead to secondary risks for the victims, such as identity theft and various forms of fraud. The scale of the alleged breach, totaling 123.58 GB, suggests a substantial volume of information is at stake.

About Gruenberg Kelly Della

Gruenberg Kelly Della is a law firm based in Long Island, New York. The organization specializes in personal injury cases and provides legal representation in several specific areas, including car accidents, medical malpractice, and wrongful death.

Analysis and industry implications

This incident suggests that law firms may become primary targets for ransomware groups due to the sensitive nature of the client data they manage. Because the firm is based in the United States, a potential data breach could lead to legal and regulatory consequences under HIPAA and relevant state laws. The sensitive nature of medical and financial records makes legal practices high-value targets for cybercriminals seeking to maximize leverage.

The dragonforce group, which emerged in 2023 and is known for providing infrastructure to affiliates, utilizes these types of double-extortion tactics to exert pressure on organizations. Double extortion is a common ransomware strategy where attackers not only encrypt an organization's data but also steal it, threatening to leak it on a public site to force payment. This method increases the pressure on the victim, as the threat of reputational damage and loss of client trust becomes a powerful motivator for negotiation.

For organizations in the professional services sector, such incidents underscore the importance of robust cybersecurity frameworks. Maintaining operational continuity is a major challenge during such attacks, as seen in the claim that the firm's phone lines were shut down. The disruption of operations, combined with the potential for long-term reputational damage and the erosion of client trust, can have lasting consequences for a firm's viability. Defensive strategies typically involve implementing strict access controls, regular data backups, and comprehensive encryption to mitigate the impact of such breaches.