Rahnama Law data allegedly leaked by frag ransomware group

• Ransomware group: frag
• Country: Iran
• Sector: Professional Services
• Announcement date: March 24, 2025

Data breach claim against Rahnama Law

The ransomware group known as frag has listed data allegedly belonging to Rahnama Law on its leak site. According to the announcement made on March 24, 2025, the threat actor claims to have conducted the attack on November 14, 2024. While the group has posted this information on their platform, public information regarding this specific threat actor remains limited.

Ransomware attacks often involve a tactic known as double extortion, where attackers not only encrypt an organization's systems but also exfiltrate sensitive data to use as leverage. By threatening to release this information on a public leak site, attackers aim to pressure the victim into paying a ransom. In this instance, the group has moved to the leak phase by listing the target's information, though no screenshots were provided to verify the contents of the alleged breach.

Details of the alleged data exfiltration

The announcement made by the frag group claims the exfiltration of a wide variety of sensitive documents and personal identifiers. The information allegedly stolen includes highly sensitive materials that could impact both the firm and the individuals it represents. The specific types of data mentioned in the claim include:

• Corporate non-disclosure agreements
• Client contact information
• Employee contact information
• Employee medical documents
• Customer medical documents
• Social security numbers
• Identification cards

The nature of these files suggests a significant breach of confidentiality. When sensitive documents such as non-disclosure agreements and identification cards are involved, the scope of the incident extends beyond mere operational disruption to the exposure of private legal and personal identities.

About Rahnama Law

Rahnama Law is a law firm that has been operating since 1996. The firm specializes in protecting the rights of victims and represents clients in various legal matters and damage recovery cases. Given its long-standing presence in the professional services sector, the firm handles a significant amount of sensitive client information and legal documentation.

Impact and security implications

The leaked data may increase the risk of identity theft and fraud for the institution's clients and employees. The exposure of medical records and social security numbers could potentially lead to long-term privacy concerns for the affected individuals. Because the institution operates within the professional services sector, this incident may pose risks regarding client confidentiality and legal obligations.

There is a possibility that the threat actor could utilize this data for secondary attacks or targeted phishing campaigns. In such scenarios, stolen contact information and personal details are used to craft highly convincing fraudulent messages to further exploit the victims. Such campaigns often target the specific individuals whose data was leaked to increase the success rate of the fraud.

For organizations operating in the professional services sector, such incidents highlight the necessity of robust data security protocols. To mitigate risks, organizations often implement defensive measures such as multi-factor authentication, regular security audits, and comprehensive encryption for sensitive data at rest and in transit. Furthermore, when a breach is suspected, it is often necessary for the institution to review its security frameworks and provide formal notifications to all affected parties to fulfill legal and ethical obligations.