Sanders Legal Group listed on Genesis ransomware leak site

• Ransomware group: Genesis
• Country: United States
• Sector: Professional Services
• Announcement date: March 7, 2026

Genesis claims data exfiltration from Sanders Legal Group

The threat actor group known as Genesis has listed the Sanders Legal Group on its dedicated leak site. According to the announcement made on March 7, 2026, the group claims to have successfully targeted the firm and exfiltrated a significant volume of data. This claim follows a pattern often seen in modern cyberattacks where threat actors use leak sites to pressure victims by threatening to publish stolen information.

The Genesis group alleges that they have obtained 250 GB of data directly from the firm's file servers. This announcement specifically alleges that sensitive information belonging to the firm's clients has been compromised as a result of the attack. While the group has published this claim, no specific ransom demand has been made public in the announcement.

Details of the allegedly stolen data

The volume of data claimed by the threat actor is substantial, totaling 250 GB. The content of the exfiltrated data is described as being highly sensitive, encompassing a wide variety of confidential documents and personal information. The breach, as claimed by the attackers, involves multiple categories of data that could impact both the firm and its clients.

The allegedly exfiltrated data includes the following items:

• Client personal data
• Client medical data
• Client financial data
• Litigation files
• Confidential settlement agreements
• Non-disclosure agreements (NDAs)
• Network user personal folders

The nature of these files suggests a deep intrusion into the organization's digital environment, targeting various types of sensitive information stored across the network.

About Sanders Legal Group

Sanders Legal Group is a law firm based in Atlanta, Georgia, located in the United States. The firm provides specialized legal services in several critical areas, including personal injury and compensation claims. Given the nature of their professional services, the firm handles a high volume of sensitive documentation related to their clients' legal matters.

Risk assessment and industry implications

This alleged breach may pose a high risk due to the nature of a law firm handling sensitive client information. The exposure of client medical and financial records could lead to legal consequences under relevant US state laws and regulations such as HIPAA. Furthermore, the disclosure of confidential settlement agreements could damage the firm's professional reputation and client trust.

From a security perspective, the leaked documents may facilitate identity theft and targeted phishing attacks against the affected individuals. When sensitive personal, medical, and financial data is exposed, it provides malicious actors with the necessary components to conduct highly convincing social engineering campaigns against the victims.

In the broader context of cyber threats, this incident highlights the risks associated with double extortion tactics. In such scenarios, ransomware groups do not just encrypt data but also steal it, using the threat of public exposure to increase their leverage. Organizations in the professional services sector often face these risks because they act as custodians of highly sensitive, regulated information. To defend against such threats, organizations typically implement defensive measures such as robust encryption, multi-factor authentication, and strict access controls to limit the movement of attackers within a network.

Information regarding the Genesis group remains limited, as is common with many ransomware operations that maintain a low profile despite their public claims on leak sites.