Patrick Sanders and Company, P.C. targeted by ElDorado ransomware group

• Ransomware group: ElDorado
• Country: United States
• Sector: Professional Services
• Announcement date: November 18, 2024

ElDorado claims data breach at Patrick Sanders and Company, P.C.

The threat actor known as ElDorado has listed the professional services firm Patrick Sanders and Company, P.C. on its dedicated leak site. According to the announcement made on November 18, 2024, the group alleges that it has successfully compromised the institution's data. This development follows an alleged attack date of July 16, 2024, though the group's specific methods and the full extent of the compromise remain unclear due to the limited information available regarding this particular threat actor.

Ransomware leak sites are platforms used by cybercriminals to exert pressure on their victims. These sites often serve as a public bulletin board where attackers post the names of organizations they have successfully breached. By listing a company, the threat actors aim to damage the victim's reputation and create urgency, often as part of a broader extortion strategy designed to force the organization into paying a ransom to prevent the public disclosure of sensitive information.

Details of the alleged incident

The claim made by ElDorado suggests a targeted operation against the firm. While the group has officially listed the organization on its leak site, the specific details surrounding the breach remain highly opaque. At this stage, there is no information available regarding the total volume of data allegedly stolen or the specific file count involved in the incident. Furthermore, the group has not issued a specific ransom demand or provided any screenshots to validate their claims.

Regarding the content of the breach, the listing does not provide any detailed information or screenshots regarding the nature of the allegedly leaked data. The listing names no specific data types.

About Patrick Sanders and Company, P.C.

Patrick Sanders and Company, P.C. is a professional services firm based in the United States. The organization provides a variety of specialized services, including tax return filing, small business consulting, and estate planning services. They offer a range of financial and advisory solutions intended to support a diverse array of industries through their professional expertise.

Risk assessment and industry implications

This claim suggests that the institution's client and operational data may be at risk. If the data is exposed, secondary risks such as identity theft or targeted phishing attacks may arise for the institution's clients. Because the organization is based in the United States, any potential data breach may fall under the scope of state-level privacy laws and regulations, which govern how sensitive information must be protected and how breaches must be reported.

The tactics employed here appear to align with double extortion. In a double extortion scenario, attackers do not merely encrypt a victim's systems to disrupt operations; they also steal sensitive data to use as leverage. The threat of leaking private information—such as tax or financial records—is used to increase the pressure on the organization to comply with ransom demands.

For organizations operating within the professional services sector, such incidents highlight the importance of robust cybersecurity frameworks. Common defensive steps for organizations include implementing multi-factor authentication, maintaining rigorous data encryption standards, and conducting regular security audits to identify vulnerabilities. Additionally, maintaining comprehensive backups and ensuring that employees are trained in recognizing phishing attempts can serve as critical layers of defense against the evolving tactics used by ransomware groups.