Bickel & Brewer - Press Release Listed by monti Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Law firms and other professional-services organisations have become steady targets in the ransomware economy, where attackers seek both operational disruption and leverage from sensitive client and internal records. In that landscape, the appearance of a firm’s name on a criminal leak site is a signal that demands careful, evidence-based scrutiny rather than speculation.

On 2 August 2023 it was reported that Bickel & Brewer, a United States law firm specialising in complex commercial litigation, had been listed by the monti ransomware group. Public detail remains limited: the number of people affected is unknown, and the only description of exposed material is that internal files were allegedly exfiltrated in a ransomware attack. The listing itself is a claim by the group, not an independently verified confirmation of every asserted detail.

Breaking down the breach

According to the available record, the incident was reported on 2 August 2023 under the headline that Bickel & Brewer had been listed by the monti ransomware group in connection with a press-release-style notice. The facts state that internal files were exfiltrated in a ransomware attack. No public figure has been given for the number of individuals affected, no precise attack vector or initial access method has been disclosed, and no timeline of intrusion, dwell time, or negotiation has been released in the material provided.

Because those operational particulars are undisclosed, it is not possible to describe how the attackers entered the environment, which systems were encrypted, or whether any ransom demand was paid or refused. What is known is confined to the group’s claim of a successful ransomware operation that included data theft, together with the firm’s identification as the named organisation. Readers should treat the leak-site listing as an unverified assertion by the threat actor unless and until the firm or independent investigators publish corroborating detail.

The group behind it: monti

Monti is a ransomware operation that became visible in the wake of the Conti group’s disruption, adopting similar double-extortion tactics: encrypting systems while also copying data and threatening to publish it if payment is not made. Public reporting on monti has consistently described a model that relies on leak sites to pressure victims, the use of common initial-access techniques such as compromised credentials or vulnerable remote services, and the packaging of stolen files for staged release. The group has previously listed organisations across multiple sectors, using the same pattern of naming a victim and claiming exfiltration.

In this case, the facts establish only that monti listed Bickel & Brewer and claimed internal files had been taken. No further statements attributed to the group about this specific victim—such as sample file counts, screenshots, or deadlines—are included in the provided record. Any broader characterisation of monti’s methods therefore rests on well-documented public patterns, not on inventing claims unique to this incident.

Bickel & Brewer and its sector

Bickel & Brewer was founded in 1984 and has built a reputation as a United States law firm practising exclusively in complex commercial litigation and dispute resolution. Firms of this type routinely handle high-stakes business disputes, often involving corporate clients, financial records, contracts, correspondence, and strategy documents that are both commercially sensitive and, in many cases, subject to legal privilege.

A breach affecting a litigation practice is consequential because the data such organisations hold can reveal not only internal firm operations but also the confidential affairs of clients who entrusted the firm with their disputes. Even when the precise contents of a theft remain unconfirmed, the sector’s concentration of privileged and commercially valuable information makes any credible claim of exfiltration a matter of legitimate concern for clients, opposing parties, and the firm’s own staff.

What data was at risk

The facts name the exposed material only as “internal files exfiltrated in a ransomware attack.” No inventory of file types, no confirmation of client names, financial data, identity documents, or privileged communications, and no count of records have been supplied. Exact contents are therefore unconfirmed.

Organisations of this kind typically maintain matter files, correspondence, billing and administrative records, employee information, and work product related to ongoing or concluded litigation. Those categories illustrate what is ordinarily at stake in a law-firm environment; they are not a statement of what was taken in this incident. Until a fuller disclosure appears, any assertion that specific categories of personal or client data were exposed would exceed the public record.

The real-world impact

For individuals whose information may have been among the internal files, the practical risks include potential misuse of contact details, professional or personal identifiers, or any sensitive context that could support phishing, social engineering, or reputational harm. Because the scale and composition of the data remain unknown, it is not possible to quantify how many people face elevated risk or which forms of harm are most likely.

For the firm, a ransomware event that includes claimed exfiltration can disrupt operations, trigger regulatory and ethical obligations to assess notification duties, and require sustained effort to contain systems, evaluate what left the network, and communicate with clients and staff. The absence of confirmed victim counts or data categories does not eliminate those obligations; it simply means the full scope of impact is still being determined or has not been made public.

Clients of a commercial-litigation practice may also face secondary concerns: whether privileged material was among the files, whether adversaries could gain insight into strategy, and whether contractual or regulatory notice requirements apply. Those questions can only be answered with evidence that has not been released in the facts at hand.

Were you affected?

If you have a past or present relationship with Bickel & Brewer—as a client, employee, or counterpart—consider practical steps: monitor accounts and communications for unusual activity, treat unsolicited messages that reference the firm or legal matters with caution, and follow any official guidance the firm issues about the incident. Because the number of people affected and the precise data types remain unknown, individual exposure cannot be confirmed from the public record alone.

You can also run a free exposure scan of your email address to check whether your information has already surfaced in known breach data sets. That step does not replace official notification, but it can help you decide whether additional monitoring or credential changes are warranted while fuller details, if any, emerge.

AICompiled with AI assistance from public sources and published under our editorial standards.