RansomHub ransomware group lists hickorylaw.com on its leak site

• Ransomware group: RansomHub
• Country: United States
• Sector: Professional Services
• Announcement date: March 6, 2025

RansomHub claims data breach at Hickory Law

The RansomHub ransomware group has officially listed hickorylaw.com on its dedicated leak site. According to the announcement, the threat actor group claims to have successfully obtained and published various documents belonging to the law firm. This development marks a significant potential breach for the professional services entity, as the group asserts they have access to sensitive internal and client-related documentation.

Details of the alleged attack

The claim was made on March 6, 2025. The RansomHub group is identified as a Ransomware-as-a-Service (RaaS) operation that first emerged in early 2024. Reports indicate that the group grew its influence by absorbing affiliates from the ALPHV group. While the group's activities were reportedly said to have ceased in early 2025, they continue to be a notable name in the threat landscape. In this instance, the group has moved from the initial encryption phase to the public disclosure phase, a common tactic used to exert pressure on victims.

Ransomware leak sites serve as a platform for cybercriminals to host stolen data, often using it as leverage in extortion attempts. When a group utilizes a leak site, it typically follows a pattern of increasing pressure on the target organization. This often involves a process known as double extortion, where attackers not only encrypt an organization's systems but also steal sensitive data, threatening to release it publicly unless a ransom is paid. If the claims regarding this incident are confirmed, it is highly probable that Hickory Law has been subjected to these double extortion tactics.

Alleged leaked data types

The leaked samples identified in the announcement include a variety of highly sensitive documents. The information allegedly exposed includes:

• Medical records
• Bank account information
• Contractual documents
• Internal administrative reports

No information was provided regarding the total size of the data stolen or the specific number of files involved. Additionally, no specific ransom demand has been disclosed in the public listing.

About Hickory Law

Hickory Law is a law firm based in North Carolina, United States. The firm provides various legal consulting and representation services to both individual and corporate clients.

Impact and security implications

The alleged exposure of such sensitive information carries heavy implications for the firm and its stakeholders. The presence of medical records and bank details in a public leak increases the risk of identity theft and financial fraud for the firm's clients and employees. Furthermore, because the organization operates as a law firm, the leak could negatively impact client confidentiality and the fundamental principle of attorney-client privilege.

As a United States-based entity, this incident may trigger investigations regarding state-level data protection laws. Furthermore, the nature of the leaked medical records may lead to potential HIPAA compliance requirements and scrutiny. Beyond the immediate legal and regulatory risks, the public disclosure of this data could damage the firm's reputation and facilitate secondary phishing attacks, where criminals use the stolen information to craft highly convincing fraudulent communications.

Organizations in the professional services sector often face these types of sophisticated threats. To mitigate such risks, it is common practice for firms to implement robust defensive measures. These include maintaining strict access controls, implementing multi-factor authentication, and conducting regular security awareness training for all employees. Additionally, maintaining comprehensive data encryption and ensuring regular, offline backups are critical components of a modern cybersecurity posture to defend against the evolving tactics of RaaS groups.