Marta Montserrat Areny Guerrero ABOGADO listed by Qilin ransomware group

• Ransomware group: Qilin
• Country: Spain
• Sector: Professional Services
• Announcement date: December 7, 2025

Qilin ransomware group claims breach of Spanish law firm

The Qilin ransomware group has listed the law firm Marta Montserrat Areny Guerrero ABOGADO on its dedicated leak site, claiming to have successfully executed a data breach against the organization. This announcement, made on December 7, 2025, marks a new incident involving the professional services sector in Spain.

Details of the claimed attack

According to the announcement posted on the group's leak portal, the threat actor known as Qilin claims to have gained unauthorized access to the network of Marta Montserrat Areny Guerrero ABOGADO. The group asserts that they have successfully exfiltrated sensitive data from the organization's systems. To support their claims and exert pressure on the victim, the group has provided samples of documents related to the firm's operations. These samples are intended to demonstrate the successful theft of information, a common tactic used by ransomware groups to demand a ransom or to increase pressure during negotiations.

Ransomware groups often utilize leak sites to host information stolen during an attack. This process is frequently part of a strategy known as double extortion. In a double extortion scheme, attackers do not merely encrypt an organization's files to disrupt operations; they also steal sensitive data and threaten to publish it publicly if the ransom is not paid. This increases the pressure on the victim, as the threat of a public data leak can cause significant reputational and legal damage, even if the organization has backups to restore its systems.

Information regarding the leaked data

The specific content of the leaked data remains uncertain at this time. While the group has provided screenshots to support their claim, the documents within these images appear to be blurred, making it impossible to determine the exact nature of the files. However, given the professional nature of the organization as a law firm, it is possible that the stolen information includes client details or various legal documentation.

The listing does not provide specific details regarding the total size of the data exfiltrated or the exact number of files stolen. Furthermore, no specific ransom demand has been made public in the announcement.

Organization profile

Marta Montserrat Areny Guerrero is an independent lawyer based in Spain. The professional is registered with the Barcelona Bar Association (ICAB) and provides specialized legal consulting and advocacy services to her clients.

Potential risks and organizational implications

This incident poses a significant risk regarding the exposure of confidential information that may have been shared between the law firm and its clients. Because the organization is based in Spain, this breach could potentially lead to legal consequences under the EU General Data Protection Regulation (GDPR), which mandates strict protections for personal data.

The involvement of the Qilin group, which has been known as a Ransomware-as-a-Service (RaaS) provider since 2022, introduces additional risks. In a RaaS model, developers lease their ransomware code to affiliates who carry out the actual attacks, which can lead to a high volume of diverse targets. The use of double extortion suggests that secondary threats, such as the sale of data on the dark web or targeted phishing attacks against the firm's clients, remain a significant concern. Clients of the firm could potentially face risks such as identity theft if their personal information is compromised.

For organizations in the professional services sector, such incidents highlight the critical importance of robust cybersecurity measures. To mitigate these risks, organizations typically focus on implementing strong access controls, maintaining regular offline backups, and conducting thorough employee training to prevent initial access via phishing. Monitoring for unauthorized data exfiltration and ensuring compliance with regional data protection regulations are also essential components of a modern defensive posture.