Schlam Stone & Dolan LLP data allegedly leaked by Anubis ransomware group

• Ransomware group: Anubis
• Country: United States
• Sector: Professional Services
• Announcement date: March 27, 2026

Anubis ransomware group claims breach of Schlam Stone & Dolan LLP

The threat actor known as Anubis has listed data on its leak platform that it claims belongs to the law firm Schlam Stone & Dolan LLP. In an announcement published on March 27, 2026, the group alleges that documents concerning the firm's work with various government institutions and Fortune 500 companies have been compromised. The post includes various legal correspondence and financial documents as samples of the alleged breach.

Details of the alleged data leak

According to the announcement made by the Anubis group, the leaked content is quite extensive and involves sensitive documentation. The group claims to have access to various types of information that could be highly damaging if released. The specific types of data mentioned in the leak announcement include:

• Legal court documents
• Tax returns
• Settlement agreements
• Financial reports

While the group has provided samples of the alleged breach, no specific information was provided regarding the total size of the data stolen or the total file count. Furthermore, there was no mention of a specific ransom demand in the public announcement.

About Schlam Stone & Dolan LLP

Schlam Stone & Dolan LLP is a New York-based law firm specializing in commercial litigation, white-collar defense, and appellate practice. The firm provides legal services to a diverse range of clients, from government institutions to Fortune 500 companies.

Analysis and potential impact of the incident

This incident may pose a risk of exposing sensitive data belonging to the clients represented by the law firm. Law firms may be high-profile targets due to attorney-client privilege, and this situation could potentially lead to secondary risks such as targeted phishing attacks. As the institution is based in the US, it may be expected that data protection compliance processes under relevant state laws and federal regulations will be triggered.

Information about the Anubis group is limited, and it may be assessed that the group conducts such leaks using double extortion methods. Double extortion is a common tactic used by modern ransomware groups, where the attackers not only encrypt the victim's data but also threaten to leak it on a public site if the ransom is not paid. This adds significant pressure on the victim organization, as the threat of public exposure can cause irreparable reputational damage and legal consequences.

The potential impact on the government institutions and large companies represented by the firm may also pose risks regarding supply chain security. When a service provider, such as a law firm, is compromised, the breach can ripple through its entire client base. This highlights the importance of robust cybersecurity measures for professional service firms that handle highly sensitive information for major corporations and government entities.

Defensive considerations for professional services

Organizations in the legal sector often face unique challenges due to the sensitive nature of the information they handle. To mitigate the risks associated with such breaches, organizations typically focus on several key areas of defense. Implementing strong access controls and multi-factor authentication is essential to prevent unauthorized access to sensitive client files. Additionally, continuous monitoring of network traffic can help in the early detection of suspicious activities that might indicate a breach in progress.

Regular security awareness training for employees is also a critical component of a defensive strategy, as human error remains a common entry point for attackers. Furthermore, maintaining comprehensive backups and ensuring they are isolated from the primary network can help an organization recover more quickly in the event of a ransomware attack. Given the potential for secondary risks like phishing, organizations should remain vigilant and implement strict verification processes for all communications involving sensitive data or financial transactions.