Miller Johnson Jones Antonisse & White listed on genesis ransomware leak site

• Ransomware group: genesis
• Country: United States
• Sector: Professional Services
• Announcement date: February 17, 2026

The law firm Miller Johnson Jones Antonisse & White has been listed on the leak site of the genesis ransomware group. According to the announcement made by the threat actors, the firm has been targeted in a data breach, with the group claiming to have exfiltrated a significant volume of sensitive information from the organization's infrastructure.

The claimed attack and data exfiltration

The genesis group announced the targeting of Miller Johnson Jones Antonisse & White on February 17, 2026. In the announcement, the threat actor claims to have successfully exfiltrated approximately 4.7 TB of data from the firm's file servers. This massive volume of data suggests a deep intrusion into the organization's digital environment.

The announcement indicates that the group intends to publish various confidential documents and client information. This type of threat is characteristic of double extortion tactics, a common method used by modern ransomware groups. In these scenarios, attackers do not just encrypt an organization's systems to disrupt operations; they also steal sensitive data to use as leverage. By threatening to leak private information on a public leak site, the attackers aim to pressure the victim into paying a ransom to prevent the exposure of their most sensitive assets.

The scope of the alleged data breach

The data allegedly stolen by the genesis group is highly sensitive, given the nature of the victim organization's operations. The threat actor claims that the stolen information includes a wide array of confidential records that could impact many individuals and the firm itself. The alleged data includes:

• Client personal data
• Medical records
• Criminal records
• Financial data
• Litigation files
• Confidential settlement agreements
• Non-disclosure agreements
• Company financial data
• Personal folders of network users

The inclusion of such diverse data types—ranging from medical and criminal records to litigation files and settlement agreements—highlights the potential impact of the breach. Such a broad spectrum of information suggests that the attackers gained access to various departments and file repositories within the firm's network.

Potential consequences and industry implications

This leak claim may present a high level of severity due to the potential exposure of sensitive client information held by a law firm. The presence of medical and criminal records could lead to legal consequences under relevant US state laws and regulations such as HIPAA. Furthermore, there is a possibility that clients may be subjected to identity theft or targeted phishing attacks as a result of this exposure.

Beyond the individual impact on clients, the publication of confidential litigation files and agreements could undermine the firm's professional reputation and result in significant commercial damage. For professional services firms, trust is a foundational element of their business model; the exposure of private legal strategies or confidential agreements can have long-lasting repercussions on client relationships and business continuity.

While public information regarding the genesis group remains limited, this incident underscores the ongoing risks faced by the professional services sector. Organizations in this sector often handle highly sensitive, regulated, and confidential information, making them prime targets for sophisticated cybercriminals. To defend against such threats, organizations typically implement multi-layered security strategies, including robust access controls, continuous monitoring of network traffic, and comprehensive data encryption to protect information both at rest and in transit. Regular security audits and employee training on phishing awareness are also standard defensive steps to mitigate the risk of initial access by threat actors.