Votava Nantz & Johnson listed on dragonforce ransomware leak site

• Ransomware group: dragonforce
• Country: United States
• Sector: Professional Services
• Announcement date: July 28, 2025

A data breach claim against Votava Nantz & Johnson

The threat actor known as dragonforce has published an announcement on its leak site regarding a purported cyberattack against the United States-based law firm Votava Nantz & Johnson. The announcement, which was posted on July 28, 2025, claims that the group has successfully compromised the organization's network and exfiltrated a significant volume of data.

Ransomware attack patterns often involve a technique known as double extortion. In these scenarios, threat actors do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive information to use as leverage. By threatening to release stolen data on public leak sites, attackers aim to pressure the victim into paying a ransom to prevent the exposure of confidential information. This method increases the pressure on organizations, especially those handling sensitive client data, as the reputational and legal consequences of a leak can be severe.

Details of the dragonforce claim

According to the information provided by the dragonforce group, the attack was claimed to have occurred on July 28, 2025. The group alleges that they have obtained a substantial amount of information from the firm's internal network. Based on the screenshots and details provided in the leak site announcement, the total volume of the exfiltrated data is reported to be 100.8 GB.

The group has not provided information regarding a specific ransom demand or the total number of files involved in the breach. The announcement serves as a public claim of the successful exfiltration of data belonging to the law firm.

Data and information involved

The announcement specifically mentions that the stolen data includes sensitive information belonging to the firm's clients. The specific types of data identified in the claim are:

• Customer data

The presence of customer information in a breach involving a legal practice is particularly concerning due to the highly sensitive nature of the documentation typically maintained by such firms. While the exact file types or specific identities of the affected individuals have not been detailed in the public announcement, the sheer volume of 100.8 GB suggests a significant amount of organizational and client-related material was targeted.

About Votava Nantz & Johnson

Votava Nantz & Johnson (VNJ Law) is a professional services firm operating within the United States, specifically in the states of Kansas and Missouri. The firm specializes in a variety of legal matters, including personal injury cases, auto accidents, medical malpractice, and wrongful death. With over 75 years of combined experience, the firm is established as a provider of personalized legal support to its clients.

Risk assessment and industry implications

This alleged data breach poses a significant risk due to the confidential nature of the relationship between a law firm and its clients. Because law firms are responsible for storing sensitive personal information and detailed case files, the leaked data could potentially be exploited by various actors for identity theft or targeted phishing campaigns. In such campaigns, attackers use stolen information to craft highly convincing messages to trick individuals into revealing even more sensitive credentials or funds.

Furthermore, the structure of the dragonforce group, which reportedly provides infrastructure to various affiliates, may increase the likelihood that the data could be misused by multiple different threat actors. For an organization operating in the United States, an incident of this nature may trigger legal proceedings under state-level data protection regulations and professional conduct rules governing legal practitioners.

To defend against such threats, organizations in the professional services sector often implement various cybersecurity measures. These include robust encryption for data at rest and in transit, multi-factor authentication (MFA) to secure access to sensitive networks, and continuous monitoring to detect unauthorized exfiltration. In the event of a suspected breach, organizations typically initiate notification processes for affected clients and conduct thorough reviews of their cybersecurity posture to prevent future occurrences.