Lorber, Greenfield & Polito, LLP listed on Qilin ransomware leak site

• Ransomware group: Qilin
• Country: United States
• Sector: Professional Services
• Announcement date: October 28, 2025

Qilin ransomware group targets Lorber, Greenfield & Polito, LLP

The Qilin ransomware group has officially listed the law firm Lorber, Greenfield & Polito, LLP on its dedicated leak site. According to the announcement made on October 28, 2025, the threat actor claims to have successfully gained access to the organization's network and obtained data. This listing serves as a public claim by the group that an intervention against the firm's digital assets has occurred.

Details of the claimed attack

The threat actor known as Qilin posted the listing on its leak portal on October 28, 2025. The group's claim suggests a successful intrusion into the network of the professional services firm. While the group asserts that they have obtained data through this unauthorized access, the specific details regarding the nature of the breach remain limited to the group's own claims on their portal.

Regarding the specific information that may have been compromised, there is no clear information regarding the nature of the leaked or threatened data in the provided records or screenshots. The listing does not specify the types of files, the volume of data, or the specific contents that the group intends to use for extortion.

About Lorber, Greenfield & Polito, LLP

Lorber, Greenfield & Polito, LLP is a professional services organization based in the United States. The firm provides specialized legal services, with a primary focus on insurance defense, construction law, and commercial litigation.

Implications and risks of the threat

The Qilin group is known for employing double extortion methods. In such scenarios, threat actors not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage. By threatening to publish stolen data on public leak sites, the group attempts to pressure the victim into paying a ransom to prevent the exposure of confidential information.

Because the target is a law firm, this situation presents significant risks regarding client confidentiality and the potential exposure of sensitive legal documents. Such a breach could lead to complex legal proceedings under state-level data protection laws in the United States, as well as potential violations of professional ethical obligations. Furthermore, if data is leaked, it could potentially be used by malicious actors for identity theft or targeted phishing attacks against the firm or its clients.

The group's past activities suggest a pattern of targeting similar organizations, and the publication of data could result in substantial reputational damage to the firm. To defend against such threats, organizations in the professional services sector often implement various defensive measures. These include maintaining robust, offline backups to ensure data recovery, implementing multi-factor authentication across all access points, and conducting regular security awareness training to prevent initial access via phishing. Additionally, continuous monitoring of network traffic and strict access controls are essential components of a comprehensive cybersecurity posture designed to mitigate the impact of such intrusions.