Rooks Rider Solicitors listed on Termite ransomware leak site

• Ransomware group: Termite
• Country: United Kingdom
• Sector: Professional Services
• Announcement date: February 25, 2025

Termite claims data breach at Rooks Rider Solicitors

The threat actor known as Termite has listed Rooks Rider Solicitors on its leak site, claiming to possess 130 GB of data allegedly belonging to the firm. This announcement, made on February 25, 2025, follows an alleged attack date of February 19, 2025. The listing indicates a significant potential exposure of sensitive information belonging to the professional services firm.

According to the claims made by the Termite group, the stolen data was obtained from the firm's networks. To support these claims, the group provided a screenshot in their announcement. This screenshot displays a list of various files that appear to belong to the law firm, suggesting that the threat actor has access to internal documentation.

Details of the claimed stolen data

The information disclosed in the leak site announcement suggests that the breach involves a wide range of sensitive documents. Based on the screenshot provided by the threat actor, the files appear to include various types of legal and administrative documentation. The content of the leaked files is reported to include:

• Client personal data
• Bank details
• Tax documents
• Employment contracts
• Legal correspondence

The presence of such diverse documentation—ranging from financial records to private legal communications—highlights the potential sensitivity of the data the group claims to have exfiltrated.

About Rooks Rider Solicitors

Rooks Rider Solicitors is a boutique law firm that was founded in 1761. The firm specializes in several key areas of law, including corporate law, real estate, and wealth planning. Operating on an international scale, the firm provides personalized legal solutions to both individual and corporate clients.

Impact and implications of the incident

This incident may lead to the exposure of sensitive client and operational data within Rooks Rider Solicitors. Given the nature of the firm, the leaked data could fall under the scope of the UK GDPR. The disclosed documents might expose clients to risks such as identity theft or targeted phishing attacks. Furthermore, the firm's reputation could be negatively impacted by such a disclosure.

Information regarding the Termite group is limited. In incidents of this nature, organizations often face complex challenges regarding data protection and regulatory compliance. The firm may need to fulfill data breach notification requirements and inform the affected parties.

In the broader context of cybersecurity, ransomware groups often utilize a tactic known as double extortion. In this scenario, attackers do not only encrypt a victim's systems to disrupt operations but also steal sensitive data to use as leverage. By threatening to leak the stolen information on a public leak site, attackers aim to pressure the organization into paying a ransom to prevent the public disclosure of confidential files.

For organizations in the professional services sector, maintaining robust defensive measures is critical. Common defensive steps include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training to prevent phishing. Additionally, monitoring network traffic for unusual data exfiltration patterns can help identify an attack in its early stages. As seen in this case, the potential for identity theft and phishing attacks against clients makes the protection of sensitive legal and financial data a primary concern for law firms globally.