Cors & Bassett Listed by SilentRansomGroup Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to treat professional-services firms as high-value targets, relying on the sensitivity of client files and the operational disruption that encrypted systems create. Against that backdrop, the listing of Cors & Bassett by the group known as SilentRansomGroup on 20 March 2025 fits a familiar pattern: an organisation is named on a leak site, internal files are claimed to have been taken, and the public is left with limited verified detail.

What is known so far is that Cors & Bassett appears on SilentRansomGroup’s site in connection with a ransomware incident in which internal files were said to have been exfiltrated. The number of people affected remains unknown, and no independent confirmation of the group’s claims has been published. For clients, employees and counterparties of a long-established firm, even an unverified listing raises practical questions about exposure and next steps.

Inside the incident

Public reporting states that Cors & Bassett was listed by SilentRansomGroup on 20 March 2025. The only data description provided is that internal files were allegedly exfiltrated in a ransomware attack. No technical details of the initial access method, encryption timeline, ransom demand or negotiation have been disclosed. The scale of the incident—how many systems were affected, how large the data set was, or whether any systems remain offline—is likewise unconfirmed. The firm’s own public statements, if any, are not included in the available record. In short, the incident is known primarily through the threat actor’s claim rather than through a detailed victim disclosure or regulatory filing.

Who is SilentRansomGroup?

SilentRansomGroup is a ransomware operation that has appeared in public reporting as a double-extortion actor: it encrypts systems and simultaneously claims to have stolen data, then threatens to publish the material if payment is not made. Like many such groups, it maintains a leak site where it posts victim names and, in some cases, sample files. Its tactics typically include phishing or exploitation of remote-access services, followed by lateral movement, data staging and encryption. Prior activity attributed to the group has involved organisations across professional services, manufacturing and other sectors, though each listing must be treated as a claim until independently verified. In this case the group claims Cors & Bassett as a victim and asserts that internal files were taken; those assertions have not been corroborated by the facts available here.

About Cors & Bassett

Cors & Bassett is described as a firm with a long, rich history spanning many decades and as a member of the business community. Public knowledge of similarly named professional-services practices indicates that such organisations commonly operate as law firms or multi-disciplinary advisory practices. Firms of this type routinely hold client correspondence, contracts, litigation materials, financial records, employee data and other confidential information. A breach involving a practice with that profile is consequential because the data often includes personal identifiers, privileged communications and commercially sensitive material belonging to third parties who never chose the firm’s security posture. Even when the precise contents remain unconfirmed, the mere possibility of exposure can affect client trust, regulatory obligations and ongoing legal matters.

What was likely exposed

The only data type named in the available record is “internal files” said to have been exfiltrated. No inventory of file categories, no sample documents and no confirmation of personal data elements have been published. Organisations of this kind typically maintain client files, billing records, human-resources documents, email archives and internal memoranda. Those materials can contain names, addresses, Social Security or tax identifiers, bank details, medical or family information, and privileged legal advice. Because the facts do not list specific fields or confirm any of those categories, it is accurate only to say that internal files are claimed to have been taken and that the exact contents remain unconfirmed. Readers should treat any more granular description as speculation until further disclosure appears.

The real-world impact

For individuals whose information may have been among the internal files, the practical risks include identity theft, targeted phishing that references real matters, and the long-term circulation of personal details on criminal markets. Even without confirmed Social Security numbers or financial account data, names, contact details and case-related context can be enough for social-engineering attacks. For the firm itself, consequences can include operational disruption while systems are restored, potential regulatory notification duties, contractual obligations to clients, and reputational harm that outlasts the technical recovery. Because the number of people affected is unknown and the data types are only broadly described, the full scope of these risks cannot yet be quantified; the uncertainty itself is part of the impact.

If your data was in this claimed breach

If you have a past or present relationship with Cors & Bassett—as a client, employee, vendor or opposing party—treat the listing as a prompt for caution rather than confirmed compromise. Monitor financial and credit accounts for unexpected activity, enable multi-factor authentication on email and other critical services, and be sceptical of unsolicited messages that reference legal matters or request urgent action. Consider placing a fraud alert or credit freeze if you believe sensitive identifiers may have been involved. You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets; such a check will not confirm or rule out this specific incident, but it can surface other exposures that warrant attention. Keep records of any official notices you receive from the firm or from regulators, and follow only instructions that come through verified channels.

AICompiled with AI assistance from public sources and published under our editorial standards.