Carnelutti Law Firm Listed by losttrust Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On September 26, 2023, Carnelutti Law Firm was listed by the ransomware group losttrust, which claimed that internal files had been exfiltrated in a ransomware attack. The number of people affected remains unknown, and public detail beyond the group's listing is limited. For a corporate law firm that handles sensitive client and business matters, any confirmed or claimed compromise of internal material carries clear consequences for clients, counterparties, and the firm itself.

This article sets out what has been reported, what is known about the threat actor, the nature of the organisation and its sector, and the practical implications for anyone who may be affected. Claims originating from the group's leak site are treated as claims, not as independently verified findings.

What happened

According to reporting dated September 26, 2023, Carnelutti Law Firm appeared on a listing associated with the losttrust ransomware group. The group claims that internal files were exfiltrated in a ransomware attack. No public confirmation of the full scope, the precise method of intrusion, the duration of any unauthorised access, or a verified count of affected individuals has been included in the available facts. The number of people affected is unknown. Beyond the characterisation of the material as internal files taken in a ransomware incident, further technical or forensic detail has not been disclosed in the record provided.

Ransomware incidents of this type typically involve both encryption of systems and theft of data for leverage. In this case, the public record centres on the leak-site listing and the claim of exfiltration rather than on independently published incident reports, timelines, or recovery statements from the firm. Readers should treat the listing as an unverified claim unless and until additional confirmation appears from the organisation or other authoritative sources.

Inside losttrust

Losttrust is a ransomware operation that became visible in the threat landscape in 2023. Like many contemporary ransomware groups, it has been associated with double-extortion tactics: encrypting victim environments while also copying data and threatening to publish it if a ransom is not paid. Groups operating in this model commonly maintain leak sites where they name victims, post samples or larger data sets, and set deadlines intended to pressure payment. Public reporting on losttrust has generally placed it among the cohort of actors that target organisations across multiple sectors rather than a single industry niche.

Typical tactics observed across this class of actor include initial access through compromised credentials, exposed remote services, or phishing; lateral movement inside the network; exfiltration of selected file stores; and deployment of ransomware. Specific claims that losttrust has made about Carnelutti Law Firm are limited to what appears in the listing itself—namely that the firm was hit and that internal files were exfiltrated. No further statements attributed to the group about this victim are included in the facts, and none are invented here.

Carnelutti Law Firm and its sector

Carnelutti Law Firm is described as one of the best-known corporate law firms in the Italian market, with a strong international orientation. Its stated aim is to serve as a key advisor to corporate clients, delivering legal and tax services that combine specialised expertise with coordinated teamwork across practice areas. The firm emphasises services tailored to individual clients and core values that include innovation, responsiveness, and client dedication.

Corporate law firms routinely hold large volumes of confidential material: client identities and structures, contracts and deal documents, correspondence, tax and regulatory advice, litigation files, and internal working papers. They also maintain their own operational records—human resources data, financial information, and systems credentials. A breach affecting such an organisation is consequential because the data often belongs not only to the firm but to clients and third parties who entrusted it under professional confidentiality expectations. Exposure can affect ongoing transactions, regulatory positions, and personal or commercial privacy far beyond the firm's own walls.

What was likely exposed

The facts state that internal files were exfiltrated in a ransomware attack. No more granular inventory—such as specific document categories, email archives, client lists, or employee records—has been named in the available record. The exact contents therefore remain unconfirmed.

Organisations of this kind typically hold client matter files, contracts, legal opinions, tax-related documents, correspondence, billing and administrative records, and internal firm data. It is reasonable to expect that a theft of "internal files" could touch some combination of those categories, but it would be inaccurate to assert any particular data type as proven fact. Until the firm or independent investigators publish a clearer accounting, the scope should be treated as undisclosed beyond the general claim of internal-file exfiltration.

What's at stake

For individuals and companies whose information may have been held by the firm, the primary risks are misuse of confidential business or personal details, targeted phishing or social-engineering attempts that reference real matters, and potential commercial or reputational harm if sensitive deal or dispute information surfaces. Even when full data sets are not published, the mere possibility of exposure can create lasting uncertainty for clients and counterparties.

For the firm, stakes include operational disruption from ransomware, the cost and complexity of investigation and remediation, professional and regulatory obligations around client confidentiality, and erosion of trust if clients conclude that their matters were put at risk. Because the number of people affected is unknown and the precise data types beyond "internal files" are not detailed in the public facts, the concrete scale of harm cannot yet be measured from the available record alone.

What to do if you're exposed

If you are a client, employee, or other party who may have had information with Carnelutti Law Firm, treat unsolicited contacts that reference the firm or your matters with caution. Prefer official channels you already trust when verifying any notice. Monitor financial and account activity where relevant, and consider placing fraud alerts or additional authentication on important accounts. Preserve any formal notification you receive from the firm for your records.

You can also run a free exposure scan of your email address to check whether your information has already surfaced in known breach data sets. That step does not confirm or rule out involvement in this specific incident, but it can help you prioritise further monitoring and password changes on accounts that appear in prior breaches. Stay alert for credible updates from the organisation itself rather than relying solely on claims posted by threat actors.

AICompiled with AI assistance from public sources and published under our editorial standards.