Simpkins Law Firm listed by CRPxO following alleged data breach

• Ransomware group: CRPxO
• Country: United States
• Sector: Professional Services
• Announcement date: July 27, 2026

Simpkins Law Firm targeted by CRPxO ransomware group

The ransomware group known as CRPxO has listed the United States-based Simpkins Law Firm on its leak site. In the announcement, which appeared on July 27, 2026, the threat actor group claims to have successfully infiltrated the organization's network and exfiltrated a significant volume of sensitive information. The group alleges that the total size of the stolen data amounts to 31.2 GB.

The incident follows a pattern observed in modern cyberattacks where threat actors target high-value professional services to maximize leverage. While the group's specific identity and technical capabilities remain limited in the public domain, their recent activity against Simpkins Law Firm highlights the ongoing risks faced by legal institutions. At this time, no specific ransom demand has been made public by the group regarding this incident.

Alleged infiltration and threat of publication

According to the claims made by CRPxO, the group gained unauthorized access to the internal network of Simpkins Law Firm. The group has threatened to publish the stolen data if their demands are not met, a tactic often associated with double extortion. In a double extortion scheme, attackers do not merely encrypt a victim's systems to disrupt operations; they also steal sensitive data to use as leverage, threatening to leak the information to the public or its clients to pressure the organization into paying a ransom.

The group's announcement suggests a targeted approach, focusing on the sensitive nature of the files held by a law firm. By threatening to release documents that contain deeply personal and confidential information, the attackers aim to create maximum reputational and legal pressure on the victim organization. Information regarding the specific methods used by CRPxO to breach the network remains unavailable in public intelligence reports.

Sensitive data types allegedly exfiltrated

The content of the alleged leak is described as being highly sensitive, particularly given the legal nature of the firm's work. The group claims to have obtained a wide array of documents that could cause significant harm if released. The following data types have been identified in the group's claim:

• Client case files
• Personal information of minors
• Financial records
• Employee HR data
• Social Security Numbers (SSN)

Beyond these categories, the group specifies that the stolen data includes adoption case files, records of minors, divorce and custody documents, child support calculations, and domestic violence restraining orders. Furthermore, the claim includes client retainer agreements, billing histories, employee payroll data, and corporate insurance policies.

Profile of Simpkins Law Firm

Simpkins Law Firm is a legal practice based in the United States. The firm primarily operates within the field of family law, a sector that inherently involves handling highly sensitive, private, and confidential information regarding domestic matters, child welfare, and personal financial details.

Potential consequences and industry implications

The nature of the data allegedly stolen poses severe risks to the affected individuals. For the clients of Simpkins Law Firm, the exposure of family law documents, such as custody records and divorce filings, could lead to significant privacy violations and increase the risk of identity theft. Furthermore, the inclusion of Social Security Numbers and payroll data for employees introduces additional layers of personal risk for the firm's staff.

From a legal and ethical standpoint, a breach of this magnitude in a law firm may result in serious consequences regarding attorney-client privilege. Because the organization is based in the United States, the incident may trigger legal proceedings under relevant state laws and data protection regulations. Additionally, there is a risk of secondary attacks, such as phishing, where criminals use the stolen information to target the individuals involved in the leaked files.

For organizations in the professional services sector, such incidents underscore the necessity of robust cybersecurity frameworks. Defensive measures typically include implementing multi-factor authentication, maintaining strict access controls, and ensuring comprehensive encryption for data at rest and in transit. Regular security audits and employee training are also vital components of a modern defense-in-depth strategy to mitigate the risk of unauthorized network access and data exfiltration.