De Rose Lawyers Listed by rhysida Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target professional-services firms that hold sensitive client records, using double-extortion tactics that combine encryption with the threat of public data leaks. Against that backdrop, De Rose Lawyers was listed on 25 October 2024 by the Rhysida ransomware group, which claims to have exfiltrated internal files during an attack on the firm.

Public detail remains limited: the number of people affected is unknown, and the precise contents of the files have not been independently confirmed. The listing itself is a claim by the group rather than a verified disclosure by the firm. Even so, any compromise of a personal-injury practice raises concrete risks for clients whose medical, financial and litigation records may be among the materials involved.

Inside the incident

According to the available record, De Rose Lawyers was listed by the Rhysida ransomware group on 25 October 2024. The group asserts that internal files were exfiltrated in a ransomware attack. No further technical details—such as the initial access vector, the duration of the intrusion, the volume of data taken, or whether systems were also encrypted—have been publicly disclosed. The number of individuals whose information may be involved is likewise unknown. At present the incident rests on the group’s leak-site claim; independent confirmation of the scope or method has not been reported.

The group behind it: rhysida

Rhysida is a ransomware operation that emerged in mid-2023 and has since conducted double-extortion campaigns against organisations across healthcare, education, government and professional services. The group typically gains initial access through phishing, compromised credentials or unpatched remote-access services, then deploys ransomware that both encrypts systems and steals data. Victims are pressured to pay a ransom under threat that the stolen material will be published on Rhysida’s dedicated leak site. The group has previously claimed responsibility for attacks on hospitals, schools and law firms, often posting sample files to demonstrate possession of the data. Its listings are public claims; they do not by themselves prove that every file advertised was in fact taken or that the victim has verified the intrusion. In this case, Rhysida’s listing of De Rose Lawyers is presented solely as the group’s assertion that internal files were exfiltrated.

Who is De Rose Lawyers?

De Rose Lawyers describes itself as a litigation firm with more than forty years of combined experience, dedicated exclusively to personal-injury law. Firms of this type routinely handle medical records, insurance correspondence, employment histories, financial statements and detailed accounts of accidents or injuries. They also maintain privileged communications between lawyers and clients, case strategies and settlement negotiations. Because personal-injury matters often involve vulnerable individuals seeking compensation for physical or psychological harm, the data held by such practices is both sensitive and long-lived. A breach at a firm of this kind is therefore consequential not only for the organisation’s operations and reputation but for the privacy and potential safety of the people it represents.

What was likely exposed

The only data type named in the public record is “internal files” said to have been exfiltrated in a ransomware attack. No inventory of specific documents, no count of records, and no confirmation of whether client files, employee data or administrative materials were included has been released. Organisations that practise personal-injury law typically store medical reports, diagnostic images, billing information, contact details, witness statements and correspondence with insurers and opposing counsel. Whether any of those categories were among the files claimed by Rhysida remains unconfirmed. Readers should treat the exact contents as unknown until the firm or an independent investigation provides further detail.

Why it matters

If client or employee information was among the internal files, affected individuals face practical risks that can persist for years. Medical and injury-related data can be used for targeted social-engineering attempts, identity theft or insurance fraud. Contact details and case histories may enable more convincing phishing or extortion attempts directed at the victims themselves. For the firm, the incident can disrupt case work, trigger regulatory notification duties, and require costly forensic and legal response. Even when the precise scale is unknown, the combination of a ransomware claim and the sensitive nature of personal-injury records means that anyone who has been a client or employee of De Rose Lawyers has a legitimate interest in understanding whether their information may have been involved and in taking proportionate protective steps.

What to do if you're exposed

If you have reason to believe your information may have been held by De Rose Lawyers, begin by monitoring financial and insurance accounts for unusual activity and consider placing a fraud alert with the major credit-reporting agencies. Change passwords on any accounts that may have shared credentials with the firm, and enable multi-factor authentication wherever it is available. Be alert to unexpected emails or calls that reference your legal matter or medical history; treat such contacts with caution and verify them through known channels. You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets. Finally, watch for any official notification from the firm itself, which may provide more specific guidance once the investigation progresses.

AICompiled with AI assistance from public sources and published under our editorial standards.