Salvi, Schostok & Pritchard P.C. targeted in alleged data breach by frag group

• Ransomware group: frag
• Country: United States
• Sector: Professional Services
• Announcement date: March 24, 2025

Frag group claims data exfiltration from Salvi, Schostok & Pritchard P.C.

The ransomware group known as frag has announced a data breach involving the law firm Salvi, Schostok & Pritchard P.C. According to a post published on a leak site on March 24, 2025, the group claims to have successfully exfiltrated sensitive information belonging to the organization. While the group has made these claims, the accuracy and the full scope of the alleged data theft have not yet been verified by independent sources.

The group's announcement suggests that the initial unauthorized access to the institution's network occurred on October 18, 2024. This indicates that the attackers may have maintained presence within the network for several months before the public announcement was made. Information regarding the specific identity and operational details of the frag group remains limited in the public domain.

Details of the alleged data theft

According to the claims made by the frag group, a wide variety of sensitive documents and information were compromised during the attack. The group asserts that the stolen data includes highly confidential records that could be used for malicious purposes. No screenshots were provided by the group to substantiate their claims regarding the contents of the stolen data.

The types of data allegedly exfiltrated include:

• Customer medical documents
• Client contact information
• Employee contact information
• Partnership agreements
• Licenses
• Contracts
• Medicare documents

The presence of medical and Medicare documents suggests that the breach may involve highly sensitive personal health information, which is subject to strict regulatory oversight in many jurisdictions.

About Salvi, Schostok & Pritchard P.C.

Salvi, Schostok & Pritchard P.C. is a professional services firm operating within the legal sector. Based in Illinois, United States, the law firm specializes in litigation related to medical malpractice and personal injury. Due to the nature of their legal practice, the firm handles significant amounts of sensitive client information, including medical records and personal details essential to their legal proceedings.

Potential impact and industry implications

This alleged data breach poses significant risks regarding client confidentiality and the protection of sensitive medical information. Because the victim is a US-based law firm, the incident may trigger legal proceedings under HIPAA and other relevant state laws designed to protect sensitive data. The nature of the stolen data, particularly contact information and medical documents, could potentially be utilized by malicious actors for identity theft or targeted phishing attacks.

In modern cyberattacks, ransomware groups often employ double extortion tactics. This method involves not only encrypting an organization's data to disrupt operations but also threatening to leak sensitive information on public leak sites to pressure the victim into paying a ransom. For a law firm, such tactics can lead to a severe loss of client trust, as the core of the legal profession relies on the confidentiality of client communications and records.

Organizations in the professional services and legal sectors can take several defensive steps to mitigate such risks. Implementing robust encryption for data at rest and in transit, enforcing multi-factor authentication (MFA) across all network access points, and maintaining rigorous patch management protocols are standard industry practices. Furthermore, regular security awareness training can help employees identify phishing attempts, which are often the initial vector for such breaches. Given the complexity of modern threats, continuous monitoring of network traffic and maintaining offline, immutable backups are also critical components of a resilient cybersecurity posture.