Wier Boerner Allin listed on interlock ransomware leak site

• Ransomware group: interlock
• Country: United States
• Sector: Professional Services
• Announcement date: August 22, 2025

Architecture firm Wier Boerner Allin targeted by interlock ransomware group

The architecture and design firm Wier Boerner Allin has been listed on the leak site operated by the interlock ransomware group. The threat actor group claims to have successfully exfiltrated data belonging to the organization, marking a potential significant breach for the professional services entity.

Details of the alleged data leak

According to the announcement published on August 22, 2025, the interlock group claims to have targeted Wier Boerner Allin on the same day. The listing includes a screenshot that serves as evidence for their claims. This visual evidence suggests that the volume of stolen information is substantial, totaling approximately 2.27 TB in size.

The provided screenshot displays specific directory structures that the group claims to have accessed. These directories include:

• 'Shared drives' (approximately 2.2 TB)
• 'ws' (approximately 76.5 GB)

While the directory names and sizes have been identified, the listing does not provide any specific details regarding the actual nature or content of the leaked data. No information was provided regarding a ransom demand or the specific files contained within these directories.

About Wier Boerner Allin

Wier Boerner Allin (WBA) is a professional design firm that specializes in providing architecture, interior design, and planning services. The company maintains a significant presence in the professional services sector, primarily focusing on developing projects for the public sector. Their client base includes various municipalities and educational institutions, which often requires the handling of sensitive infrastructure and institutional data.

Potential impact and industry implications

The alleged leak poses a significant risk to the organization, particularly given its involvement in projects for the public and educational sectors. The exposure of such data could lead to the compromise of sensitive corporate information and critical project details. Such an event may result in negative impacts on the firm's commercial reputation and could potentially lead to legal consequences stemming from the breach of confidentiality agreements established with their clients.

Because Wier Boerner Allin is a United States-based entity, the breach may trigger various notification obligations under different state-level data protection regulations. Furthermore, if the stolen data contains information pertaining to employees or clients, the organization may face secondary risks, including the potential for identity theft or targeted phishing attacks against those individuals.

This incident highlights the growing trend of double extortion in ransomware attacks. In these scenarios, threat actors do not only encrypt an organization's systems but also steal sensitive data to use as leverage during negotiations. By threatening to publish the stolen information on public leak sites, attackers aim to maximize pressure on the victim. For organizations in the professional services sector, maintaining robust defensive measures is critical. These measures typically include implementing strict access controls, maintaining offline backups, and ensuring comprehensive encryption for data both at rest and in transit to mitigate the impact of such breaches.

Information regarding the interlock group remains limited, making it difficult to determine their specific tactics, techniques, and procedures beyond this single listing.