Rhysida claims law firm Gress Clark Young data
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Rhysida ransomware group lists law firm Gress Clark Young & Schoepper as a victim, claiming theft of 166GB including PHI, SSNs and financial records.
Ransomware.live tracked a listing by the Rhysida ransomware group naming Gress Clark Young & Schoepper, a law firm, as a victim. The claimed leak totals approximately 167,804 files (~166.4 GB) and reportedly includes sensitive data such as banking details for the firm and its clients, SSNs and signatures of clients/witnesses, W-9/I-9/W-4 tax forms with driver's license and SSN card copies, and QuickBooks financial records including voided checks bearing signatures.
The disclosure also allegedly includes Board of Industrial Insurance Appeals (BIIA) case-management materials such as default orders, internal conference notes, and expert consulting-fee payment records, as well as extensive protected health information (PHI) including medical imaging, X-rays, and Activity Prescription Forms. Notably, the listing references a 'coaching letter' to a physician in a specific legal matter, suggesting potential witness-handling ethics violations, alongside credentials for the SPC court e-filing system and references to internal disciplinary action against a named partner.
This is a single-victim entry from a ransomware leak-site tracking service rather than original technical research; no information on the initial access vector, exploited vulnerabilities, or ransomware payload behavior is provided. Defenders in the legal services sector, particularly firms handling PHI, SSNs, and court e-filing credentials, should treat this as a reminder to review data-handling practices for sensitive client and litigation records and monitor for credential exposure tied to court e-filing systems.
Mentioned in this report
Source reporting: https://www.ransomware.live/id/R3Jlc3MgQ2xhcmsgWW91bmcgJiBTY2hvZXBwZXJAcmh5c2lkYQ==
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs