Portnoff Law Associates listed on ALPHV ransomware leak site

• Ransomware group: ALPHV
• Country: United States
• Sector: Professional Services
• Announcement date: July 26, 2023

ALPHV claims data breach at Portnoff Law Associates

The ALPHV ransomware group has listed Portnoff Law Associates on its leak site, claiming to possess a significant amount of the firm's private data. According to the announcement, the group asserts that they have acquired 265 GB of information belonging to the organization. This development highlights the ongoing risks faced by professional service firms by sophisticated threat actors.

Details of the claimed attack

The incident involves the ALPHV (also known as BlackCat) ransomware group, which listed Portnoff Law Associates on its dedicated leak site. While the announcement was made public on July 26, 2023, the group claims the attack itself occurred earlier, specifically on February 4, 2023. Furthermore, the group has stated that the data in question was uploaded to their platform on January 29, 2023.

Ransomware groups often utilize leak sites to pressure victims into paying ransoms. This process frequently involves a tactic known as double extortion. In a double extortion scheme, attackers do not only encrypt an organization's files to disrupt operations but also exfiltrate sensitive data before the encryption occurs. The threat of releasing this stolen data publicly serves as additional leverage to compel the victim to meet ransom demands.

Data involved in the leak claim

The announcement on the leak site claims that 265 GB of the institution's private data has been compromised. However, no detailed information regarding the specific nature of the data has been shared by the attackers. The listing names no specific data types or categories of information that were allegedly stolen.

About Portnoff Law Associates

Portnoff Law Associates is a law firm that has been established since 1989. The firm specializes in the collection of delinquent real estate taxes and municipal fees. Their services are primarily directed toward municipalities, school districts, and various authorities located in Pennsylvania.

Risk assessment and implications

Given that law firms handle sensitive client information and municipal data, these leak claims may increase the risk of identity theft and fraud for clients. Considering the firm's engagement with municipalities and school districts in Pennsylvania, the breach may potentially create secondary risks for public administration processes. The sensitivity of the data handled by such firms makes them high-value targets for cybercriminals seeking to exploit personal or governmental information.

The ALPHV group's methods are notable for using Rust-based ransomware. This programming language is increasingly used by sophisticated actors to develop malware that is efficient and harder to reverse-engineer. Public information regarding the group indicates that it emerged in late 2021 and reportedly ceased operations as of March 2024.

As a US-based institution, the incident may likely lead to legal proceedings under relevant state laws and data protection regulations. For organizations in the professional services sector, maintaining robust cybersecurity postures is essential. Common defensive steps for organizations include implementing multi-factor authentication, maintaining regular offline backups, conducting regular security awareness training for employees, and ensuring that all software and systems are promptly patched against known vulnerabilities. These measures help mitigate the risk of both initial access and the subsequent exfiltration of sensitive data.