Law Offices of Michael A. Freedman, P.A. targeted by Aurora ransomware group

• Ransomware group: Aurora
• Country: United States
• Sector: Professional Services
• Announcement date: April 29, 2026

Aurora ransomware group claims data breach at Law Offices of Michael A. Freedman, P.A.

The threat actor known as Aurora has listed the Law Offices of Michael A. Freedman, P.A. on its leak site, claiming a significant data breach. According to the announcement made on April 29, 2026, the group alleges it has exfiltrated a vast amount of sensitive information belonging to the Maryland-based law firm. The claim involves approximately 579 GB of data, consisting of 196,701 files.

Details of the alleged attack and data exfiltration

The Aurora group claims to have successfully gained access to the firm's internal systems. The breach is alleged to have occurred around April 23, 2026, according to the group's claims. The threat actor asserts that the stolen information spans a period from 2019 to 2026, potentially exposing years of historical and current organizational and client data.

The leaked content is said to be highly sensitive, encompassing various types of legal, financial, and personal documentation. The group claims the stolen data includes the following:

• Client medical records
• Attorney-client correspondence
• Bank account credentials
• Password data
• Patent and invention documents
• Employee personal data

In addition to the items listed above, the group claims the exfiltrated data includes HIPAA authorizations, Sage ACT databases, federal EINs, and invention disclosures.

About the Law Offices of Michael A. Freedman, P.A.

The Law Offices of Michael A. Freedman, P.A. is a professional services firm located in Maryland, USA. The firm specializes primarily in personal injury litigation and criminal defense. Beyond these core legal areas, the firm also provides specialized services in patent consulting and invention promotion.

Potential impact and industry implications

This incident, as claimed by the Aurora group, may pose a significant risk to client confidentiality and the established principle of attorney-client privilege. The exposure of such sensitive information can have long-lasting consequences for both the firm and its clients. Specifically, the disclosure of bank credentials and password lists could facilitate secondary attacks against the firm's financial assets and various third-party platforms.

Furthermore, because the firm is a US-based entity, the exposure of medical records and other sensitive data may lead to regulatory scrutiny under HIPAA and various state-level data protection laws. For the clients involved, the disclosure of personal information increases the risk of identity theft and makes them targets for highly specific, targeted phishing campaigns.

In the broader context of cyber threats, this incident reflects the tactics often used in double extortion ransomware attacks. In these scenarios, threat actors do not just encrypt a victim's systems to demand a ransom for decryption; they also steal sensitive data to threaten its public release. This adds a layer of pressure on organizations, as the threat of reputational damage and legal penalties from data exposure can be as significant as the operational disruption caused by encryption.

For organizations in the professional services sector, such incidents highlight the critical importance of robust cybersecurity frameworks. Common defensive steps for organizations include implementing multi-factor authentication (MFA) across all platforms, maintaining rigorous encryption for data at rest and in transit, and conducting regular security awareness training for employees to prevent phishing. Additionally, maintaining strict access controls and conducting frequent audits of system logs can help detect unauthorized access before large-scale exfiltration occurs. While public information regarding the Aurora group remains limited, this claim underscores the ongoing risks faced by legal institutions handling sensitive client information.