Thilges & Bernhardt, Attorneys at Law targeted by Qilin ransomware group

• Ransomware group: Qilin
• Country: United States
• Sector: Professional Services
• Announcement date: January 14, 2025

Qilin ransomware group claims data breach at Thilges & Bernhardt

The Qilin ransomware group has listed the law firm Thilges & Bernhardt on its dedicated leak site, alleging that the firm's data has been compromised. According to the announcement made on January 14, 2025, the threat actor group claims to have successfully exfiltrated data belonging to the organization. This development follows a claimed attack date of January 12, 2025.

Ransomware attacks involving data exfiltration are a growing concern for professional service providers. In these scenarios, attackers typically gain unauthorized access to a network and steal sensitive information before deploying encryption. The threat of releasing this stolen data on a public leak site serves as a primary leverage tool for the attackers.

Details of the alleged incident

The Qilin ransomware group has announced that the stolen data is scheduled to be published on January 19, 2025. While the group has confirmed the intent to publish, the specific details regarding the volume of data or the exact nature of the files remain undisclosed by the attackers. The group has provided a screenshot intended to serve as proof of the breach; however, the images displayed within the screenshot are blurred, making the specific content of the documents impossible to identify or verify.

The lack of clarity in the provided evidence means that the exact scope of the compromise remains unknown at this time. No specific information has been provided regarding the total size of the data or the exact number of files that were allegedly taken during the operation.

The target organization

Thilges & Bernhardt is a law firm established in 1991. The firm specializes exclusively in family law and provides legal counsel and representation services to its clients. The organization operates with a professional team consisting of four attorneys.

Implications and potential risks

The Qilin group is known to operate using double-extortion tactics. This methodology involves both encrypting an organization's systems and threatening to publish exfiltrated data to pressure the victim into paying a ransom. Given that the victim is a law firm, the leaked data may contain sensitive client information and confidential legal documents. Such a breach could potentially lead to identity theft or targeted phishing attacks against the firm's clients.

Furthermore, the institution may face legal and administrative sanctions under US state laws and professional ethical standards. Considering the group's past activities, the publication of the data could result in significant reputational damage and operational disruptions for the firm.

For organizations in the professional services sector, such incidents highlight the necessity of robust defensive measures. Common defensive steps include implementing multi-factor authentication, maintaining offline backups, and conducting regular security awareness training to prevent initial access. Protecting client confidentiality is paramount, as a breach can lead to long-term legal and professional consequences for the firm involved.