safepay ransomware group lists feldmanandlopez.com on its leak site

• Ransomware group: safepay
• Country: United States
• Sector: Professional Services
• Announcement date: December 16, 2025

Miami law firm targeted by safepay ransomware group

The Miami-based law firm Feldman & Lopez, P.A. has been listed on the leak site of the ransomware group known as safepay. According to an announcement published by the threat actors, the firm has been targeted in a cyberattack involving data exfiltration.

Claims regarding the attack and methodology

The threat actor known as safepay claims to have targeted Feldman & Lopez, P.A. in an announcement published on December 16, 2025. The post alleges that access to the firm's network was obtained on October 22, 2025. The group states that it has exfiltrated data using a double-extortion tactic and threatens to publish the information.

Double-extortion is a common ransomware tactic where attackers not only encrypt a victim's systems to disrupt operations but also steal sensitive information before encryption. The goal of this method is to pressure the victim into paying the ransom by threatening to leak the stolen data publicly, which can lead to significant reputational damage, regulatory fines, and loss of client trust.

Details regarding the allegedly exfiltrated data

There is no specific detail provided in the announcement regarding the type or content of the allegedly exfiltrated data. The screenshot provided by the group contains only general information about the firm's areas of practice.

Affected data types

• No specific data types were named in the listing.

Organization profile

Feldman & Lopez, P.A. is a law firm based in Miami, Florida. They specialize in property insurance law and related legal fields.

Impact assessment and industry implications

Given that law firms handle sensitive client information and litigation files, such a breach may compromise client confidentiality. As the firm is based in the US, a potential data breach could lead to legal consequences under state-level data protection laws and professional conduct regulations. The double-extortion tactic employed by the safepay group suggests that the exfiltrated data may be used for secondary risks such as identity theft or targeted phishing attacks.

Due to the nature of the firm's sector, the breach could negatively impact supply chain security and client trust. In the professional services sector, maintaining the integrity of client data is paramount to operational success and legal compliance. When sensitive legal documents or personal identifiers are compromised, the ripple effects can extend to the clients themselves, potentially exposing them to further targeted social engineering or fraudulent activities.

Organizations in the legal and professional services sectors often implement various defensive measures to mitigate these risks. Common strategies include maintaining robust backup solutions, implementing multi-factor authentication across all remote access points, and conducting regular security awareness training for staff to identify phishing attempts. Additionally, maintaining strict access controls ensures that sensitive litigation files are only accessible to authorized personnel, reducing the potential blast radius of a network compromise.