Miguel Veiga, Neiva Santos e Associados listed on Direwolf ransomware leak site

• Ransomware group: Direwolf
• Country: Portugal
• Sector: Professional Services
• Announcement date: October 14, 2025

The Direwolf ransomware group has listed the Portuguese law firm Miguel Veiga, Neiva Santos e Associados on its dedicated leak site. According to the announcement made by the threat actors, the organization has been targeted in a cyberattack, resulting in the alleged theft of a significant volume of sensitive information.

The claimed attack and timeline

The threat actor claims to have gained unauthorized access to the firm's systems following an incident that allegedly occurred on October 5, 2025. The group officially announced the breach on their leak site on October 14, 2025. According to the claims made by the Direwolf group, the total amount of data exfiltrated during the incident is approximately 100 GB.

The group has outlined a specific schedule for the release of the stolen information. They announced plans to publish a list of files and a selection of sample files on October 25, 2025. Following this preliminary release, the group stated their intention to release all the documents associated with the breach on November 11, 2025.

The alleged stolen data

The announcement provided by the Direwolf group specifies the nature of the information they claim to have exfiltrated from the law firm. The data is said to consist of the following:

• Legal document data

While the group has specified the type of data, no specific information was provided regarding the total file count or the specific ransom demand requested by the attackers.

About Miguel Veiga, Neiva Santos e Associados

Miguel Veiga, Neiva Santos e Associados is a professional services organization operating within the legal sector. The firm is based in Porto, Portugal, and provides a range of legal consulting and advocacy services across various areas of law.

Potential impact and industry implications

This incident may pose significant risks to client confidentiality and the security of sensitive legal information. Because the firm is based in Portugal, the potential leak of such data could trigger legal sanctions and complex compliance processes under the General Data Protection Regulation (GDPR). The exposure of sensitive client information can create opportunities for malicious actors to conduct identity theft or launch targeted phishing attacks against the firm's clients.

In the context of modern cyber threats, this incident highlights the risks associated with double extortion tactics. In these scenarios, ransomware groups not only encrypt an organization's data but also steal it, threatening to publish it on a leak site to pressure the victim into paying a ransom. This method is particularly damaging to professional services firms, where the value of the data is tied to confidentiality and trust.

Information regarding the Direwolf group remains limited, which is common for many ransomware operations. The publication of a firm's data can lead to a significant loss of professional reputation and introduces various third-party risks. For organizations in the professional services sector, maintaining robust security postures is essential to mitigate these risks. This typically involves implementing strong access controls, continuous monitoring, and comprehensive data encryption to protect sensitive client files from unauthorized exfiltration.