Town Counsel Law & Litigation listed on Rhysida ransomware leak site

• Ransomware group: Rhysida
• Country: United States
• Sector: Professional Services
• Announcement date: February 12, 2025

Rhysida ransomware group targets Town Counsel Law & Litigation

The Rhysida ransomware group has officially listed the law firm Town Counsel Law & Litigation on its dedicated leak site. This announcement, made on February 12, 2025, marks a significant escalation in the threat actor's campaign against the professional services sector. According to the claims made by the group, the breach occurred on the same day the announcement was posted.

Details of the claimed data exfiltration

The Rhysida ransomware group claims to have successfully exfiltrated a massive dataset from the firm's infrastructure. The group asserts that the stolen information totals 483 GB in size and consists of 363,687 individual files. In their announcement, the threat actors stated that a portion of this stolen data remains unsold on the dark web and has been made available to other malicious actors for potential use.

The leaked data reportedly contains highly sensitive information that could be exploited for various illicit purposes. Based on sample documents shared on the leak site, the following types of data are included in the breach:

• Insurance policies
• Driver's licenses
• Medical records
• Legal correspondence

About Town Counsel Law & Litigation

Town Counsel Law & Litigation is a client-focused law firm based in the United States. The organization specializes in municipal law and focuses on the resolution of various local government issues, serving as a legal representative for municipal and public entities.

Implications and security risks

This breach presents several critical risks. For the individuals whose sensitive personal and medical information has been exposed, there is a heightened risk of identity theft and fraud. Because the firm specializes in municipal law, the disclosure of confidential information related to municipal and public entities could lead to secondary security risks for those government bodies.

Furthermore, as the organization is based in the United States, this incident may trigger legal proceedings regarding data privacy violations under both state laws and federal regulations. The tactics used by the Rhysida group appear to follow the pattern of double extortion. In such scenarios, threat actors not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage. By publishing data on a leak site, they aim to exert maximum pressure on the organization through the threat of public disclosure, which often results in significant reputational damage.

To defend against such threats, organizations in the professional services sector typically focus on robust data protection strategies. This includes implementing strict access controls, maintaining comprehensive logging and monitoring to detect unauthorized exfiltration, and ensuring that sensitive client data is encrypted both at rest and in transit. Regular security awareness training and maintaining an updated incident response plan are also vital components of a modern cybersecurity posture designed to mitigate the impact of ransomware and data leaks.