Law Offices of R. David Williams, P.A. targeted by Rhysida ransomware group

• Ransomware group: Rhysida
• Country: United States
• Sector: Professional Services
• Announcement date: September 30, 2026

The Rhysida ransomware group has listed the Law Offices of R. David Williams, P.A. on its leak site, claiming to have exfiltrated sensitive client data from the United States-based firm. The threat actors have posted an announcement regarding the breach, asserting that they have successfully compromised the organization's systems and obtained a significant volume of confidential information.

The claimed attack and data exfiltration

On September 30, 2026, the Rhysida group announced that they had targeted the Law Offices of R. David Williams, P.A. According to the claims made by the threat actors, they have obtained approximately 206 GB of data specifically related to the firm's criminal defense practice. The group is currently leveraging this stolen data on their dedicated leak site as a method to exert pressure on the organization.

Ransomware groups often utilize leak sites to host stolen information as part of a double-extortion tactic. In such scenarios, attackers do not merely encrypt an organization's files to demand a ransom for decryption; they also threaten to publish sensitive data online to coerce the victim into paying. This method increases the pressure on the target, as the exposure of private information can lead to severe reputational damage, legal liabilities, and loss of client trust.

Details of the alleged leaked data

The information allegedly leaked by the Rhysida group is highly sensitive, as it pertains to the legal proceedings and personal details of the firm's clients. The group claims that the stolen data includes criminal defense files for approximately 175 clients. The scope of the breach appears to cover a wide range of investigative and personal records, including:

• Client criminal defense files
• Police discovery records
• Bodycam footage
• 911 audio recordings
• Jail calls
• Incident reports
• Fingerprint cards
• Risk Protection Orders (RPO)
• Victim and witness data

The nature of these files suggests that the breach involves highly confidential legal materials that are typically protected by strict privacy standards and legal privilege.

Organization profile

The Law Offices of R. David Williams, P.A. is a law firm based in the United States. Specializing in criminal defense, the firm provides legal representation and consulting services to clients across various criminal cases and legal proceedings.

Implications and organizational risks

This incident presents a significant risk regarding the exposure of highly sensitive personal and legal data belonging to the firm's clients. Given that the firm operates in the US, the breach may lead to legal consequences concerning state-level data protection laws and attorney-client privilege. The exposure of victim and witness information could potentially lead to identity theft or targeted phishing attacks against the affected individuals.

Considering the double-extortion tactics of the Rhysida group, the publication of this data may severely damage the firm's reputation and compromise client safety. The Rhysida group, which emerged in 2023, remains a threat actor for which public information remains limited.

For organizations in the professional services sector, such incidents highlight the critical importance of robust cybersecurity frameworks. To mitigate the risks of data exfiltration, organizations often implement strategies such as multi-factor authentication, rigorous access controls, and comprehensive encryption for data at rest and in transit. Furthermore, maintaining regular, offline backups and conducting regular security awareness training can help defend against the evolving tactics used by ransomware groups to gain access to sensitive environments.