Falk, Waas, Hernandez, Cortina, Solomon & Bonner Overview Metrics Listed by rhysida Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
Falk, Waas, Hernandez, Cortina, Solomon & Bonner was listed by the Rhysida ransomware group on December 30, 2025, after internal files were exfiltrated in a ransomware attack; the number of individuals affected remains undisclosed. If you are a client or former client of the firm, check the firm’s notices and consider monitoring your accounts and placing fraud alerts.
Breaking down the breach
The only public record of the incident is the December 30, 2025 listing on Rhysida’s leak site. The entry claims that internal files were removed from the organization but provides no further metrics, file counts, or descriptions. No confirmation of the claim has been issued by the organization, and no independent verification of the data’s contents or volume is available. The number of individuals potentially affected is not disclosed.
The group behind it: rhysida
Rhysida is a ransomware operation that has conducted campaigns since at least 2023. Public reporting describes the group as using double-extortion tactics, in which data is both encrypted on victim systems and copied for later publication if ransom demands are not met. The group has appeared in multiple leak-site listings across different industries. In this case, the listing of Falk, Waas, Hernandez, Cortina, Solomon & Bonner constitutes a claim by the group; no additional statements or evidence from Rhysida about this specific target have been made public.
About Falk, Waas, Hernandez, Cortina, Solomon & Bonner
Falk, Waas, Hernandez, Cortina, Solomon & Bonner is a law firm. Organizations of this type routinely maintain records related to client matters, including correspondence, case documents, and administrative files. A breach affecting such an entity raises questions about the handling of information that is often subject to legal privilege or confidentiality obligations, though the exact nature of any files referenced in the listing remains unconfirmed.
What data was at risk
The listing refers only to “internal files exfiltrated in ransomware attack.” No inventory of specific document types, client identifiers, or data categories has been released. Law firms commonly store client personal information, financial details, and privileged communications, yet the precise contents of the claimed exfiltration are not publicly known.
Why it matters
Exposure of internal legal files can affect client confidentiality and ongoing matters even when the scale of the incident is unclear. For the organization, the event adds to the operational and reputational considerations that follow any ransomware claim. For individuals whose information may be contained in those files, the absence of Reported Details leaves the scope of potential impact undetermined at this time.
If your data was in this claimed breach
Monitor official statements from the organization for any future notifications. Review account statements and legal correspondence for unusual activity. Enable multi-factor authentication on any accounts that may be linked to the firm’s records.
- Change passwords for any accounts associated with the organization.
- Request a copy of your client file if you are a current or former client.
- Run a free exposure scan of your email address against known breach data.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Woodard, Emhardt, Henry, Reeves & Wagner, LLP Listed by rhysida Ransomware GroupLarry Pitt & Associates Listed by rhysida Ransomware GroupUnited Keetoowah Band of Cherokee Indians in Oklahoma Listed by rhysida Ransomware GroupSdii Global Listed by rhysida Ransomware GroupLatest breaches
Publicly posted by rhysida — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.