# Rhysida claims law firm Gress Clark Young data

Published: 2026-10-10 · Severity: elevated
Canonical: https://vorant.io/reports/d19e82c9-28fa-534a-b4d7-3270d7353393/rhysida-claims-law-firm-gress-clark-young-data

> Rhysida ransomware group lists law firm Gress Clark Young & Schoepper as a victim, claiming theft of 166GB including PHI, SSNs and financial records.

Ransomware.live tracked a listing by the Rhysida ransomware group naming Gress Clark Young & Schoepper, a law firm, as a victim. The claimed leak totals approximately 167,804 files (~166.4 GB) and reportedly includes sensitive data such as banking details for the firm and its clients, SSNs and signatures of clients/witnesses, W-9/I-9/W-4 tax forms with driver's license and SSN card copies, and QuickBooks financial records including voided checks bearing signatures.

The disclosure also allegedly includes Board of Industrial Insurance Appeals (BIIA) case-management materials such as default orders, internal conference notes, and expert consulting-fee payment records, as well as extensive protected health information (PHI) including medical imaging, X-rays, and Activity Prescription Forms. Notably, the listing references a 'coaching letter' to a physician in a specific legal matter, suggesting potential witness-handling ethics violations, alongside credentials for the SPC court e-filing system and references to internal disciplinary action against a named partner.

This is a single-victim entry from a ransomware leak-site tracking service rather than original technical research; no information on the initial access vector, exploited vulnerabilities, or ransomware payload behavior is provided. Defenders in the legal services sector, particularly firms handling PHI, SSNs, and court e-filing credentials, should treat this as a reminder to review data-handling practices for sensitive client and litigation records and monitor for credential exposure tied to court e-filing systems.

## Mentioned in this report

- Threat actors: rhysida
- Malware: Rhysida

Source reporting: https://www.ransomware.live/id/R3Jlc3MgQ2xhcmsgWW91bmcgJiBTY2hvZXBwZXJAcmh5c2lkYQ==

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/d19e82c9-28fa-534a-b4d7-3270d7353393/rhysida-claims-law-firm-gress-clark-young-data.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup