Lockbit3 claims breach of kll-law.com

• Ransomware group: Lockbit3
• Country: United States
• Sector: Professional Services
• Announcement date: May 1, 2025

The LockBit3 ransomware group has announced the listing of kll-law.com (Kagan Lubic Lepper Finkelstein & Gold, LLP) on its leak site. This announcement marks a new potential data breach involving a professional services firm based in the United States.

The details of the claim

According to an announcement published by the LockBit group on May 1, 2025, the group claims to have targeted kll-law.com. The group's post indicates that the institution was allegedly compromised on April 22, 2025. Following the initial intrusion, the threat actors have threatened to publish the institution's data, setting a deadline of May 15, 2025, for the organization to comply with their demands.

Ransomware groups often utilize leak sites to exert pressure on their victims through a tactic known as double extortion. In these scenarios, attackers do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive information to threaten its public release. This creates a dual pressure point: the need to restore operational capabilities and the need to prevent the reputational and legal damage caused by a public data leak.

Information regarding the compromised data

At this time, no specific details or file samples regarding the nature of the allegedly compromised data have been provided by the threat actors. The listing does not specify the volume of data stolen or the specific types of files involved in the breach.

The listing names no data types.

About the organization

Kagan Lubic Lepper Finkelstein & Gold, LLP is a New York-based full-service law firm. The firm has been providing legal counsel for over forty years, with a primary focus on real estate, cooperative, and condominium law.

Analysis and implications for the sector

Given that law firms handle sensitive client information and trade secrets, such a breach may lead to violations of attorney-client privilege. As a US-based institution, potential data leaks could result in legal risks concerning state-level data protection laws and professional conduct regulations. The sensitive nature of legal documentation means that any unauthorized access poses a significant threat to the confidentiality expected in professional legal services.

LockBit is a Ransomware-as-a-Service (RaaS) group that has been active since 2019. The group has reportedly reorganized following an international operation in February 2024. The publication of the institution's data could potentially facilitate secondary risks such as identity theft or targeted phishing attacks, as stolen information is often used to conduct further fraudulent activities against the original victims or their clients.

For organizations operating within the professional services sector, maintaining robust defensive postures is critical. This typically involves implementing multi-factor authentication, maintaining offline backups, and conducting regular security awareness training to mitigate the risk of initial access. Furthermore, monitoring for unauthorized data exfiltration and ensuring strict access controls can help reduce the impact of a potential compromise.