depenning.com Listed by lockbit3 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target professional-services firms that hold sensitive client and internal records, using double-extortion tactics that combine encryption with public leak-site listings. Against that backdrop, depenning.com was listed by the lockbit3 ransomware group on 6 April 2024. Public reporting states that internal files were exfiltrated during a ransomware attack; the number of people affected remains unknown. For an intellectual-property practice, any confirmed compromise of internal material raises concrete questions about client confidentiality and operational continuity.

The listing itself is a claim by the threat actor. Independent verification of the full scope, method of intrusion, or exact contents has not been made public. What follows summarises only the disclosed facts and places them in the context of the actor’s known pattern of activity and the sector in which the firm operates.

Breaking down the breach

According to the available record, depenning.com was listed by lockbit3 on 6 April 2024. The sole description of the incident states that internal files were exfiltrated in a ransomware attack. No further technical details—such as the initial access vector, the duration of the intrusion, the volume of data taken, or whether systems were also encrypted—have been disclosed. The number of individuals whose information may have been involved is listed as unknown. Because the public record consists only of the group’s leak-site claim and the brief characterisation of “internal files,” any assessment of scale or impact must remain provisional until additional confirmation appears.

Who is lockbit3?

Lockbit3 is the current iteration of a long-running ransomware-as-a-service operation that has been active for several years. The group typically recruits affiliates who conduct the intrusion and deployment stages, while the core operators maintain the ransomware payload, negotiation infrastructure and dedicated leak sites. Its standard playbook involves double extortion: data are stolen before encryption, and the threat of public release is used to pressure victims into paying a ransom. Lockbit3 has previously claimed responsibility for attacks across manufacturing, professional services, healthcare and government sectors, often publishing sample files or full archives when negotiations stall. Listings on its leak site are therefore assertions by the group rather than independently Reported Facts; they serve both as pressure and as advertising for the service. Nothing in the public record for this particular incident goes beyond the claim that depenning.com was listed and that internal files were exfiltrated.

About depenning.com

DePenning & DePenning, operating under depenning.com, provides a full range of intellectual-property law services. Firms of this type routinely handle patent applications, trademark registrations, design rights, licensing agreements and related litigation or advisory work. In the course of that practice they necessarily process confidential technical disclosures, client correspondence, draft filings, commercial terms and personal data of inventors, applicants and employees. A ransomware incident that involves the exfiltration of internal files therefore carries sector-specific weight: the material at stake is often commercially sensitive or subject to professional secrecy obligations. Public detail on the firm’s size, geographic footprint or precise technology environment is limited; the significance of the listing rests on the nature of the work rather than on any disclosed organisational metrics.

The information in question

The only data category named in the public record is “internal files exfiltrated in a ransomware attack.” No inventory of file types, no count of records, and no confirmation of whether client, employee or third-party personal data were included has been released. Organisations engaged in intellectual-property practice typically maintain case files, invention disclosures, priority documents, correspondence with patent offices, billing records and internal administrative material. Any of those categories could fall under the broad label “internal files,” yet it would be inaccurate to assert that specific classes of data were exposed. The exact contents therefore remain unconfirmed; affected parties and the firm itself are the only sources that can later clarify the scope.

Why it matters

For individuals whose information may have been among the internal files, the practical risks include potential misuse of personal identifiers, contact details or professional credentials if those elements were present. For corporate clients, the exposure of technical or commercial documents could affect competitive position or ongoing patent strategies. For the firm, the incident creates immediate operational and reputational pressures: restoring systems, assessing notification obligations under applicable data-protection rules, and managing client communications. Because the number of people affected is unknown and the precise data set is undisclosed, the concrete impact cannot yet be quantified. The listing nevertheless illustrates the broader pattern in which ransomware operators treat professional-services firms as high-value targets precisely because of the sensitivity of the material they hold.

Were you affected?

If you have had dealings with DePenning & DePenning—whether as a client, inventor, employee or service provider—consider the following first steps. Monitor financial and professional accounts for unusual activity. Request confirmation from the firm about whether your data were involved once any official notice is issued. Preserve any correspondence that may help establish the nature of your relationship with the organisation. In parallel, you can run a free exposure scan of your email address to check whether that address has already appeared in other known breach data sets; such a scan does not confirm involvement in this specific incident but can surface related exposures that warrant attention. Stay alert for official updates rather than relying solely on the threat actor’s claims.

AICompiled with AI assistance from public sources and published under our editorial standards.