Plan B Die Fachanwaltskanzlei listed on Qilin ransomware leak site

• Ransomware group: Qilin
• Country: Germany
• Sector: Professional Services
• Announcement date: September 9, 2025

The Qilin ransomware group has claimed responsibility for a cyberattack targeting the German law firm Plan B Die Fachanwaltskanzlei. According to an announcement posted on a leak site on September 9, 2025, the threat actors assert that they have successfully breached the firm's systems and acquired various sensitive documents.

The claimed attack and event details

The threat actor, identified as the Qilin group, released a post claiming to have targeted the Munich-based firm. The group alleges that they gained unauthorized access to the organization's internal systems, allowing them to extract a variety of documents. To support their claims, the group has shared sample images related to the firm's operations as part of their public announcement.

Ransomware attacks of this nature often involve a process known as double extortion. In this scenario, attackers do not merely encrypt a victim's data to demand a ransom for the decryption key; they also steal sensitive information beforehand. The threat of leaking this stolen data on a public leak site serves as additional leverage to pressure the victim into paying the ransom. This method is designed to maximize the impact on the target organization by threatening their reputation and legal standing.

The data allegedly involved in the breach

The announcement made by the Qilin group claims that the stolen information includes highly sensitive materials. According to the group's post, the following types of data are involved in the breach:

• Client files
• Personal data
• Case files

The group has provided screenshots that purportedly display various document samples belonging to the law firm to demonstrate the scope of the data they have allegedly acquired.

Organization profile

Plan B Die Fachanwaltskanzlei is a law firm that was founded in Munich in 2014. The firm specializes in criminal law and provides defense services for a variety of criminal cases.

Impact assessment and industry implications

This incident may pose significant risks to the law firm's clients and to ongoing legal proceedings. Because the firm operates within Germany, the breach could potentially lead to data protection violations and legal sanctions under the General Data Protection Regulation (GDPR). The exposure of clients' personal information can create a foundation for further malicious activities, such as identity theft or targeted phishing attacks against the individuals involved.

Furthermore, the Qilin group's use of the double extortion method could result in substantial corporate reputation damage through the public dissemination of stolen data. Given the strict confidentiality obligations inherent to the legal profession, this situation may also result in consequences regarding professional liability for the firm.

For organizations operating within the professional services sector, such as law firms, maintaining robust cybersecurity posture is critical. Common defensive steps include implementing multi-factor authentication (MFA) across all systems, maintaining offline backups of critical data, and conducting regular security awareness training for employees to recognize phishing attempts. Additionally, strict access controls and encryption of sensitive client data can help mitigate the impact of a potential breach. As seen in this case, the intersection of legal confidentiality and data protection regulations means that cyber incidents in this sector carry heavy regulatory and professional weight.