Brown and Streza Listed by losttrust Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On September 26, 2023, the law firm Brown and Streza was listed by the ransomware group losttrust, which claimed to have carried out an attack involving the exfiltration of internal files. The number of people affected remains unknown, and public detail on the incident is limited to the group's listing and the reported nature of the data involved.

For clients and contacts of a firm that handles sensitive personal, financial, and estate matters, any confirmed or claimed exposure of internal files raises clear questions about confidentiality and downstream risk. What is established so far is the attribution claim itself and the description of internal files taken in a ransomware attack; much else has not been publicly confirmed.

Inside the incident

According to available reporting, Brown and Streza appeared on a losttrust listing dated September 26, 2023. The group has claimed that internal files were exfiltrated in a ransomware attack. No public figure has been given for the number of individuals affected, and details such as the precise method of initial access, the duration of any intrusion, the volume of data taken, or whether encryption was deployed alongside theft have not been disclosed in the material provided.

Ransomware incidents of this type commonly involve both data theft and pressure to pay, often through a leak-site posting. In this case, the listing itself constitutes the group's claim; independent confirmation of the full scope and contents has not been set out in the reported facts. Timing beyond the September 26, 2023 report date, and any subsequent negotiation or data release, remain outside what has been publicly detailed here.

Who is losttrust?

losttrust is a ransomware operation that became visible in the public threat landscape in 2023. Like other groups in this category, it has been associated with double-extortion tactics: encrypting systems where possible while also stealing data and threatening to publish it on a dedicated leak site if demands are not met. The group has listed numerous organisations across sectors, using those listings to assert successful intrusion and data theft.

Public reporting on losttrust has generally described affiliates or operators who gain access, move laterally, exfiltrate files, and then post victim names with samples or descriptions to increase pressure. Specific technical claims the group may have made about Brown and Streza beyond the listing and the characterisation of internal-file exfiltration are not detailed in the facts at hand; those elements should be treated as the actor's unverified assertions unless corroborated elsewhere.

About Brown and Streza

Brown and Streza is a law firm whose public description of its work centres on integrated domestic and international legal services for families, businesses, entrepreneurs, investors, philanthropists, and charitable organisations. Its stated areas include comprehensive tax planning, trusts and estates planning, ultra-high-net-worth planning, trust and estate administration, the charitable sector, business planning, mergers and acquisitions, business succession planning, and real estate.

Firms operating in this space routinely hold highly sensitive client information—identity details, financial and tax records, estate and succession documents, corporate transaction materials, and correspondence with advisors. A breach or claimed breach at such an organisation is consequential because the data involved is often long-lived, difficult to change, and useful for fraud, social engineering, or competitive harm. The firm's own summary emphasises proactive service to clients, staff, and professional advisors, underscoring the trust placed in its handling of confidential matters.

The information in question

The facts name the exposed material as internal files exfiltrated in a ransomware attack. No further breakdown—such as specific document categories, client lists, or file counts—has been disclosed in the reported information. The number of people affected is unknown.

Organisations of this kind typically maintain client intake records, tax and estate planning documents, trust instruments, business and real-estate transaction files, correspondence, and internal administrative data. Whether any of those categories were among the files the group claims to have taken has not been confirmed publicly. Exact contents therefore remain unconfirmed; readers should not assume a particular data type was or was not included solely on the basis of the firm's practice areas.

The real-world impact

For individuals whose information may have been held by the firm, risks include targeted phishing or social-engineering attempts that reference genuine legal, tax, or family circumstances; identity misuse if personal identifiers were present; and longer-term exposure of private financial or succession arrangements. Ultra-high-net-worth and estate-related material, if involved, can be especially sensitive because it is hard to revoke and may affect multiple family members or entities.

For the organisation, consequences can include regulatory and professional obligations around client confidentiality, potential notification duties, reputational strain, and the operational cost of investigation and remediation. Because the scale and precise data types are not publicly established, the concrete impact on any given person cannot be stated as fact from the available record; the prudent stance is to treat the claim seriously and monitor for misuse.

If your data was in this claimed breach

If you are a client, former client, or other contact of Brown and Streza, consider practical steps: watch for unexpected communications that reference legal, tax, or estate matters and verify them through known channels; place fraud alerts or credit freezes if you believe identity data may have been involved; and review financial and tax accounts for unusual activity. Preserve any suspicious messages rather than clicking links or opening attachments.

You can also run a free exposure scan of your email address to check whether your information has already surfaced in known breach data sets. That check does not confirm or rule out involvement in this specific incident, but it can help you prioritise further monitoring and password hygiene across accounts that share the same address or credentials.

AICompiled with AI assistance from public sources and published under our editorial standards.