Mosley Glick O’Brien, Inc. targeted by BianLian ransomware group

• Ransomware group: BianLian
• Country: United States
• Sector: Financial Services
• Announcement date: March 4, 2025

BianLian claims data exfiltration against Mosley Glick O’Brien, Inc.

The threat actor group known as BianLian has officially listed the accounting firm Mosley Glick O’Brien, Inc. on its dedicated leak site. According to the announcement made on March 4, 2025, the group claims to have successfully exfiltrated approximately 1.2 TB of data belonging to the organization. The threat actor group has indicated that the stolen information will be released in blocks in the near future.

This incident follows a pattern observed with the BianLian group, which has been active since 2022. This group has notably shifted its operational focus away from traditional encryption-based ransomware toward a model centered on data exfiltration and extortion. In such double extortion schemes, attackers prioritize stealing sensitive information to leverage against the victim, using the threat of public disclosure to demand payment.

Details of the alleged data theft

The claims made by BianLian regarding the stolen dataset are extensive, suggesting a significant breach of sensitive information. The group asserts that the exfiltrated data includes a wide variety of internal and external records. According to the announcement, the following types of data have been compromised:

• Financial records
• Client financial data
• QuickBooks data
• HR data
• Business contracts
• Personally identifiable information (PII)
• Protected health information (PHI)
• Email correspondence

The breadth of this data suggests that the breach touches upon multiple critical business functions, from human resources and accounting to legal and client communications.

About Mosley Glick O’Brien, Inc.

Mosley Glick O’Brien, Inc. is a certified public accounting firm located in Toledo, Ohio. The company provides a range of accounting and consulting services to a diverse client base, including businesses, start-ups, non-profits, and individuals. Their professional services span several different sectors, such as construction, manufacturing, logistics, and other professional services.

Potential impact and industry risks

The alleged breach of an accounting firm presents several significant risks. For the clients and employees of Mosley Glick O’Brien, Inc., the exposure of personally identifiable information (PII) and protected health information (PHI) could lead to secondary threats, such as identity theft and highly targeted phishing attacks. Because the organization handles sensitive client and employee data, the exposure of PHI and PII may result in regulatory consequences under HIPAA and relevant US state data protection laws.

Furthermore, the disclosure of business contracts and trade secrets could lead to a loss of professional trust and cause long-term operational disruptions for the firm. Given the historical behavior of the BianLian group, there is a possibility that the exfiltrated data may be published publicly or sold to third parties on the dark web.

In the financial services and accounting sectors, such incidents highlight the critical importance of robust data protection strategies. Organizations in this sector often face high stakes due to the sensitive nature of the financial and personal data they manage. Defensive measures typically include implementing strict access controls, maintaining comprehensive audit logs, and ensuring regular, isolated backups. Additionally, monitoring for unauthorized data transfers and implementing strong encryption for data at rest and in transit are standard practices to mitigate the risk of large-scale exfiltration.