Pretzel-Stouffer listed on ALPHV ransomware leak site

• Ransomware group: ALPHV
• Country: United States
• Sector: Professional Services
• Announcement date: September 25, 2023

ALPHV claims data theft from Pretzel-Stouffer

The law firm Pretzel-Stouffer has been listed in a recent leak announcement by the ALPHV ransomware group. According to the claims made by the threat actors, a significant amount of data has been exfiltrated from the firm's primary servers. The group alleges that they have obtained 736 GB of data belonging to the organization.

The incident was announced on September 25, 2023. The ALPHV group has posted the organization's information on its dedicated leak site, a common tactic used by modern ransomware collectives. The group has stated that they will proceed to publish the stolen data if the firm does not initiate contact with them. This follows a pattern often seen in modern cyberattacks where the threat actors use the threat of public exposure to pressure victims into meeting their demands.

Details of the alleged data exfiltration

The breach, as claimed by the ALPHV group, involves a wide variety of sensitive information. Based on screenshots shared by the attackers, the stolen data appears to include highly confidential documents and personal identifiers. The scope of the alleged theft suggests a deep penetration into the firm's digital infrastructure.

The specific types of data mentioned in the samples include:

• Employee personal data
• CVs
• Driver's licenses
• ID cards
• Social security numbers (SSN)
• Financial reports
• Accounting data
• Loan information
• Insurance policies
• Confidential client documentation

The presence of such diverse data types—ranging from identity documents to financial and legal records—highlights the potential severity of the incident for all parties involved.

About Pretzel-Stouffer

Pretzel & Stouffer is a law firm with over 70 years of experience, specializing in complex and high-stakes legal matters. Based in Chicago, the firm is known for its exceptional trial attorneys and versatile, team-based approach.

Analysis and potential impact

The nature of the allegedly exfiltrated data presents several critical risks. For the employees and clients of the firm, the theft of personal identifiers such as social security numbers, driver's licenses, and ID cards significantly increases the risk of identity theft and targeted phishing attacks. Such attacks often leverage stolen personal details to gain further access to financial accounts or to conduct sophisticated social engineering campaigns.

Furthermore, for a professional services firm operating in the legal sector, a breach of this magnitude poses a direct threat to client confidentiality. Such a violation can lead to severe negative impacts on the firm's corporate reputation and trust. Because the organization is based in the United States, the incident may trigger specific legal obligations, including data breach notification requirements under relevant state laws and federal regulations.

The tactics employed by ALPHV align with the double extortion strategy. In this model, attackers not only encrypt systems to disrupt operations but also steal sensitive data to use as leverage. This increases the risk of data being published or sold on the dark web even if the victim attempts to recover their systems. Such situations can lead to significant disruptions in operational processes and may trigger various legal proceedings against the organization.

In general, organizations facing such threats often focus on strengthening their defensive posture through multi-factor authentication, regular security awareness training, and robust data encryption. Monitoring for unauthorized data exfiltration and maintaining comprehensive incident response plans are also vital steps for mitigating the impact of ransomware-related events.