Adnan Sundra & Low Listed by direwolf Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
Adnan Sundra & Low has been listed by the direwolf ransomware group after internal files were exfiltrated in a ransomware attack. The breach was disclosed on 22 December 2025, and anyone connected to the firm should check their status and take protective steps.
Adnan Sundra & Low, a Malaysian law firm, was listed on December 22, 2025, by the ransomware group direwolf. The listing states that internal files were exfiltrated during a ransomware attack. The number of individuals affected remains unknown, and no further details on the volume or contents of the data have been made public.
Such incidents matter because law firms routinely process confidential client information that can include personal identifiers, financial records, and privileged legal communications. When these materials are claimed to have been taken, the exposure can extend beyond the organisation itself to clients and counterparties whose data was never intended for public view.
What happened
The only confirmed public information is the December 22, 2025 listing by direwolf. The entry asserts that internal files were removed from Adnan Sundra & Low systems. No independent confirmation of the exfiltration, the date of the intrusion, or the quantity of data has been released. The scale of the incident and the precise method of access remain undisclosed.
The group behind it: direwolf
Direwolf is a ransomware operator that publishes victim names on a dedicated leak site when ransom demands are not met. The group’s pattern involves initial network access, data exfiltration, and encryption, followed by public claims if payment is withheld. Its listings function as pressure tactics rather than verified disclosures, and independent verification of each claim is rarely available at the time of posting.
About Adnan Sundra & Low
Adnan Sundra & Low operates in the legal-services sector, providing advice and representation to corporate and individual clients. Organisations of this type maintain case files, correspondence, contracts, and regulatory submissions that contain sensitive commercial and personal information. A breach affecting such an entity is consequential because the data often carries legal privilege and is subject to strict confidentiality obligations under professional and data-protection rules.
The information in question
The listing refers only to “internal files.” No specific categories of data, file counts, or client names have been published. Law firms typically hold client identities, matter-related documents, financial details, and communications protected by attorney-client privilege. The exact contents claimed in this incident are unconfirmed.
The real-world impact
Individuals whose information appears in the exfiltrated files face the possibility that personal or commercial details could be used for targeted fraud, identity misuse, or reputational harm. The firm itself may encounter regulatory scrutiny, loss of client trust, and costs associated with investigation and remediation. Because the number of affected people is unknown, the full scope of these risks cannot yet be quantified.
If your data was in this claimed breach
Monitor bank and credit accounts for unusual activity and consider placing fraud alerts with credit bureaus. Review any recent legal or financial correspondence for signs of tampering. Individuals can run a free exposure scan of their email address against known breach datasets to check whether their information has appeared in other incidents. Organisations should follow established incident-response procedures and consult legal counsel regarding notification obligations.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
HCK Capital Group Listed by direwolf Ransomware GroupGuan Chong Berhad Listed by direwolf Ransomware GroupYPC MALAYSIA Listed by direwolf Ransomware GroupMeinhardt Malaysia Listed by direwolf Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the Adnan Sundra & Low Listed by direwolf Ransomware Group →
Publicly posted by direwolf — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.