Kraken ransomware group lists www.mgl.law on its leak site

• Ransomware group: Kraken
• Country: United States
• Sector: Professional Services
• Announcement date: February 9, 2025

Kraken claims data breach against MGL Law

The threat group known as Kraken has listed www.mgl.law on its leak site, claiming to possess data belonging to the organization. This announcement, made on February 9, 2025, indicates that the threat actors are preparing data for publication. The group has shared links to file directories that they allege are associated with the organization, signaling a potential data leak involving the professional services firm.

The group's announcement follows a claimed attack date of November 28, 2024. By listing the organization on their platform, the attackers are utilizing a common tactic used by modern ransomware groups to exert pressure on their targets. These leak sites serve as a public gallery for victims of cyberattacks, where groups post information to shame organizations into paying ransoms or to demonstrate their capabilities to other potential victims.

Details of the claim and the alleged event

According to the information provided by the Kraken group, they are currently in the process of preparing data for public release. During the announcement, the threat actors shared links to specific file directories that they claim are linked to the organization. Beyond simply listing the victim, the group has indicated that interested parties can contact their support team to acquire additional private data. Furthermore, the group has made a claim that the stolen data can be purchased for personal use.

The group appears to be employing double-extortion tactics. In a double-extortion scenario, attackers do not merely encrypt an organization's files to disrupt operations; they also steal sensitive information before the encryption occurs. This allows them to threaten the victim with the public release of the data, creating a secondary layer of leverage. This method is designed to maximize pressure on an organization's operational continuity and reputation, as the threat of a data leak can be just as damaging as the loss of access to systems.

Scope of the alleged leaked data

The exact scope and nature of the alleged leaked data remain unspecified by the threat actors. The group has only provided links to file directories on its leak site, and no specific information regarding the volume or the types of files has been released at this time. The listing names no specific data types.

About MGL Law

MGL Law is a law firm based in the United States. It provides various legal consulting and representation services to individual and corporate clients. Given the nature of the organization's work in the professional services sector, the firm handles sensitive information related to its diverse client base.

Potential impact and organizational risks

This incident may result in the exposure of sensitive organizational data, which could potentially impact both clients and employees of the firm. Because the organization is based in the United States, a confirmed data breach could lead to significant legal obligations under various state laws and federal regulations. The legal landscape for data protection in the US requires organizations to adhere to specific notification and security standards to protect consumer and client privacy.

Beyond the immediate legal and regulatory concerns, secondary risks may include the use of leaked information for identity theft or targeted phishing campaigns. When sensitive data is leaked, threat actors often use it to craft highly convincing social engineering attacks, targeting individuals who were part of the breach. This can lead to further compromises of personal and professional accounts.

Public information regarding the Kraken group is limited, and their specific modus operandi remains unclear. For organizations in the professional services sector, maintaining robust security postures is essential to mitigate these risks. Common defensive steps include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training to defend against phishing. As the group's methods remain uncertain, organizations must remain vigilant against evolving extortion techniques.