Feldman & Lopez Listed by lynx Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to pressure professional-services firms by combining encryption with data theft and public leak-site listings. Law practices, which routinely hold sensitive client and insurance-related records, remain frequent targets in this double-extortion model. Against that backdrop, Feldman & Lopez appeared on a ransomware group’s site in mid-April 2025.

Public reporting indicates that the boutique South Florida law firm Feldman & Lopez was listed by the lynx ransomware group on April 16, 2025. The group claims internal files were exfiltrated during a ransomware attack. The number of people affected has not been disclosed, and independent confirmation of the full scope remains limited.

Inside the incident

According to available reporting, Feldman & Lopez was named on the lynx leak site on April 16, 2025. The listing asserts that internal files were taken in a ransomware attack. No public figure has been given for the volume of data, the number of individuals affected, or the precise date the intrusion began. Technical details of the initial access method, any encryption of systems, or ransom negotiations have not been disclosed in the material reviewed. The firm’s own public statements on the matter, if any, are not included in the provided record. As with many such listings, the group’s claim of exfiltration stands as an unverified assertion until corroborated by the organisation or independent investigators.

Inside lynx

Lynx is a ransomware operation that became publicly visible in 2024 and has since operated a double-extortion model: encrypting systems while also stealing data and threatening to publish it on a dedicated leak site if demands are unmet. The group has been observed using a ransomware-as-a-service approach, recruiting affiliates and focusing on mid-sized organisations across multiple sectors. Public reporting on prior campaigns shows typical tactics that include phishing or exploitation of exposed services for initial access, followed by lateral movement, data staging, and deployment of encryptors. Leak-site postings are used to increase pressure on victims. No specific technical claims made by lynx about the Feldman & Lopez incident beyond the listing itself are part of the known facts; the appearance of the firm’s name is treated here solely as the group’s claim.

About Feldman & Lopez

Feldman & Lopez, P.A. is a boutique law firm based in South Florida and established in 2015. Public descriptions characterise it as a practice founded by insurance specialists that provides civil and insurance litigation services to Florida residents and their assignees. The firm handles post-loss claims under homeowners’ insurance policies and offers state-wide professional services tailored to individual client needs. Law firms of this type routinely manage privileged communications, claim files, policy details, personal identifying information of clients, and related financial or medical documentation tied to insurance disputes. A breach involving such an organisation is consequential because the data often includes material protected by attorney-client privilege and information that can be reused for fraud or further social-engineering attacks against clients and counterparties.

What was likely exposed

The available facts state only that internal files were exfiltrated in a ransomware attack. Exact data types, file counts, and whether client records, emails, or financial documents were among them have not been confirmed publicly. Organisations of this kind typically hold client contact details, insurance policy and claim information, litigation files, correspondence, and internal administrative records. Because the precise contents remain unconfirmed, any list of exposed categories beyond the generic description of “internal files” would be speculative.

The real-world impact

For individuals whose information may have been among the taken files, risks include targeted phishing, identity theft, or misuse of claim-related details in insurance fraud schemes. Even partial records can enable convincing social-engineering attempts against clients or their families. For the firm, consequences can include disruption of ongoing litigation, potential regulatory or ethical obligations around client notification, reputational harm, and the operational cost of investigation and remediation. Privilege considerations add further complexity: any disclosure of confidential client matter could affect legal strategy or expose parties to secondary harm. Because the number of affected people is unknown and the exact data set is undisclosed, the full scale of these risks cannot yet be quantified from public sources.

If your data was in this claimed breach

If you are a current or former client or otherwise believe your information may have been held by Feldman & Lopez, practical first steps include the following:

• Monitor financial and insurance accounts for unexpected activity and place fraud alerts with major credit bureaus if personal identifiers may be involved.
• Treat unsolicited emails, calls, or messages that reference insurance claims or legal matters with heightened caution; verify any request through known official channels.
• Change passwords on related accounts and enable multi-factor authentication where available.
• Retain copies of any official notifications you receive from the firm or authorities for your records.
• Consider a free exposure scan of your email address against known breach data sets to check whether your information has already appeared in other incidents.

Public detail on this specific listing remains limited; further official updates from the firm or investigators would provide clearer guidance on next steps.

AICompiled with AI assistance from public sources and published under our editorial standards.