Tlusty & Kennedy listed on qilin ransomware leak site

• Ransomware group: qilin
• Country: United States
• Sector: Professional Services
• Announcement date: December 2, 2025

The law firm Tlusty & Kennedy has been listed on the leak site of the qilin ransomware group. This announcement, made on December 2, 2025, indicates that the threat actors claim to have gained access to the firm's networks, suggesting that the institution's digital assets may have come under their control.

The claimed attack and event details

According to the announcement posted by the qilin group, the attack occurred on December 2, 2025. The group's listing on their dedicated leak site serves as a public notification of the incident. In such scenarios, ransomware groups often use these platforms to pressure victims by threatening to release sensitive information if specific demands are not met.

Ransomware leak sites are a common component of modern cyber extortion campaigns. These sites act as a public gallery where threat actors post the names of organizations they have successfully compromised. This tactic is designed to maximize psychological pressure on the victim organization and its clients. When a group lists a target, it signals that they believe they have successfully bypassed the target's security perimeters and have established a foothold within the internal network environment.

Data involved in the incident

Regarding the specific nature of the information involved in this incident, there is no clear information in the record or the screenshot regarding the nature of the leaked or threatened data. The listing does not specify the types of files, the volume of information, or the specific databases that may have been accessed by the qilin group.

Potential risks associated with the data

While the specific data types remain unknown, the nature of the organization's operations suggests significant risks. In the context of ransomware, many groups employ a method known as double extortion. In this model, attackers do not just encrypt files to disrupt operations; they also exfiltrate sensitive data to use as leverage. If the ransom is not paid, the threat actors threaten to publish the stolen information on their leak site, creating secondary risks for the victim and the affected parties.

Organization profile

Tlusty & Kennedy is a law firm based in Maryland, United States. They provide legal counsel and representation in areas such as personal injury, workers' compensation, and medical malpractice.

Impact and industry implications

As a law firm, the leaked data may contain client confidentiality and sensitive legal documents. This situation may increase the risk of clients being exposed to identity theft or targeted phishing attacks. Because the firm handles sensitive legal matters, the potential exposure of private documentation poses a high risk to the privacy of their clientele.

Since this is a US-based institution, obligations may arise under state-level data breach notification laws and professional liability regulations. Organizations in the professional services sector must navigate complex legal landscapes when a breach occurs, as they are often bound by strict confidentiality agreements and regulatory requirements regarding the protection of client information.

The incident highlights the operational disruptions and reputational damage that such attacks can cause. When a service provider is compromised, it can lead to a loss of trust from clients and significant challenges in maintaining business continuity. To defend against such threats, organizations typically focus on robust network monitoring, strict access controls, and comprehensive employee training to recognize phishing attempts, which are often the initial entry point for ransomware groups like qilin.