ThreeAM ransomware group lists carrellblanton.com on its leak site

• Ransomware group: ThreeAM
• Country: United States
• Sector: Professional Services
• Announcement date: November 27, 2023

The ThreeAM ransomware group has listed the law firm carrellblanton.com on their leak site, alleging a data breach. This announcement, made public by the threat actor, suggests that the organization has been targeted in a cyberattack.

The alleged attack and claims by ThreeAM

The threat actor known as ThreeAM listed carrellblanton.com on their leak portal on November 27, 2023. According to the group's announcement, they claim to have obtained data from the firm. The group made this announcement public on the same day they allegedly gained access to the network, as it is alleged that network access was gained by the group on the date of the listing.

Ransomware groups often utilize leak sites as a component of a double extortion strategy. In such scenarios, attackers not only encrypt an organization's data to disrupt operations but also threaten to release sensitive information on public forums to pressure the victim into paying a ransom. These sites serve as a public stage for the threat actors to claim responsibility and exert psychological pressure on the targeted entities.

Details regarding the alleged leaked data

At this time, no details regarding the nature of the alleged leaked data have been shared. The screenshot provided by the group contains only the firm's general introductory text, and the listing names no specific data types.

When analyzing ransomware incidents, the lack of specific information regarding file types or data volume is common in the early stages of a leak. Organizations often face uncertainty regarding whether the breach involves intellectual property, financial records, or personally identifiable information until a full forensic investigation is completed.

About Carrell Blanton Ferris

Carrell Blanton Ferris is a boutique law firm specializing in estate planning, trust and estate administration, and elder law. The firm operates through four locations based in Virginia.

Potential implications and industry risks

Given that the target is a law firm, there may be a possibility that the leaked data contains sensitive client information and privileged records. This situation could create legal obligations under US state laws and relevant data protection regulations. Furthermore, there may be a risk of clients being exposed to identity theft or targeted phishing attacks. Beyond the direct impact on clients, the law firm could experience reputational damage and disruptions to its operational processes.

For organizations operating within the professional services sector, maintaining robust cybersecurity postures is essential to protect client confidentiality. Common defensive steps for organizations include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training for staff to recognize phishing attempts. Because information about the ThreeAM group is limited in the public domain, organizations should remain vigilant against their tactics.

Summary of risks

• Potential exposure of sensitive client information and privileged records
• Legal obligations under US state laws and data protection regulations
• Risk of identity theft or targeted phishing attacks against clients
• Reputational damage to the firm
• Disruption to operational processes