Naulty, Scaricamazza and McDevitt, LLC listed by Royal ransomware group

• Ransomware group: Royal
• Country: United States
• Sector: Professional Services
• Announcement date: December 16, 2022

The Royal ransomware group has officially listed the law firm Naulty, Scaricamazza and McDevitt, LLC on its dedicated leak site. This announcement, made on December 16, 2022, follows a claim by the threat actors that they have successfully gained unauthorized access to the systems of the professional services firm.

The claimed attack and incident details

According to the announcement posted by the threat actor known as Royal, the group claims to have breached the network of Naulty, Scaricamazza and McDevitt, LLC. The listing appeared on the group's leak site on December 16, 2022, which is the same date the group claims the attack occurred. While the group asserts they have gained access to the firm's internal systems, the specific technical methods used to achieve this breach have not been disclosed in the public announcement.

In many such ransomware incidents, threat actors utilize a tactic known as double extortion. In this scenario, attackers do not merely encrypt a victim's data to disrupt operations; they also exfiltrate sensitive information before the encryption process begins. The goal of this strategy is to pressure the victim into paying a ransom by threatening to release the stolen data on a public leak site, thereby causing reputational damage and legal consequences. Based on the nature of the listing, it is assessed that the institution may have been subjected to these double extortion tactics.

Data involvement and content

Regarding the specific information that may have been compromised during this incident, the threat actor has not provided any specific details or screenshots regarding the content of the leaked data. Furthermore, the listing does not specify the total volume of data stolen or the total count of files involved in the breach. At this time, the listing names no specific data types that have been exfiltrated.

About Naulty, Scaricamazza and McDevitt, LLC

Naulty, Scaricamazza & McDevitt, LLC is a professional services firm established in 1952. The firm maintains an operational presence across the United States, specifically serving clients in Pennsylvania, New Jersey, and Delaware. The organization specializes in several key areas of legal practice, including insurance law, litigation, and corporate counsel. Their legal representation serves a diverse range of clients across various industrial sectors, such as manufacturing, retail, and logistics.

Risk assessment and industry implications

The emergence of the Royal group in 2022, which has been linked to the Conti group and later reported to have rebranded as BlackSuit in 2023, highlights the evolving nature of the ransomware landscape. For a professional services firm like Naulty, Scaricamazza and McDevitt, LLC, the implications of a potential breach are significant. Because the firm handles sensitive legal matters, the compromise of client information and confidential case files poses a high risk to the organization and its clients.

A breach of this nature can lead to several critical consequences, including the violation of client confidentiality and the potential for legal sanctions under various United States state laws. Additionally, there is a significant risk that any exfiltrated data could be utilized by malicious actors for identity theft or for conducting highly targeted phishing attacks against the firm's clients or partners.

To defend against such threats, organizations in the professional services sector often implement various defensive measures. These include maintaining robust backup solutions, implementing multi-factor authentication across all systems, and conducting regular security awareness training for employees to recognize phishing attempts. Furthermore, continuous monitoring of network traffic and strict access controls are essential components of a modern cybersecurity posture designed to mitigate the impact of unauthorized access and data exfiltration.