fflawoffice Listed by blackbasta Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

When a law firm appears on a ransomware group's leak site, the people most directly concerned are often clients, staff, and anyone whose private matters were entrusted to that practice. In early March 2023, the Dallas firm known as fflawoffice—Friedman & Feiger—was listed by the group blackbasta, which claimed to have taken internal files in a ransomware attack. Public reporting does not state how many people were affected or precisely which records left the firm's systems. For anyone who has worked with the firm, the practical question is whether sensitive legal, financial, or personal information could now be in unauthorized hands, and what that means for privacy and ongoing legal matters.

Details remain limited. The listing itself is a claim by the attackers rather than an independently confirmed inventory of what was taken. Still, the nature of legal work means that even a partial exposure of internal files can carry lasting consequences for the people whose cases, contracts, and correspondence those files may contain.

What happened

According to public breach records, fflawoffice was listed by the blackbasta ransomware group on or about March 8, 2023. The available summary states that internal files were exfiltrated in a ransomware attack. No confirmed figure has been published for the number of people affected. The method of initial access, the duration of any intrusion, whether systems were encrypted as well as copied, and whether a ransom was demanded or paid are all undisclosed in the material provided. What is known is the group's claim that it obtained internal files and the firm's appearance on the associated leak-site listing. Beyond that claim and the reported date, public detail is limited.

The group behind it: blackbasta

Blackbasta is a ransomware operation that became widely observed in 2022. Like many contemporary groups, it has typically relied on a double-extortion model: encrypting systems to disrupt operations while also copying data so that the threat of public release or sale can pressure the victim. The group has been associated with attacks across multiple sectors and geographies, often using leak sites to name organizations and, in some cases, to publish samples or larger sets of stolen material when negotiations stall. Affiliates or partners have historically been part of how such groups scale intrusion and monetization, though the exact structure can shift over time.

In this incident, blackbasta's listing of fflawoffice should be read as the group's claim. Public records do not independently verify the full contents of any archive the group says it holds, nor do they confirm whether material was later released. Established patterns for the group include targeting organizations that hold commercially or personally sensitive records and using the prospect of exposure to increase leverage. Those patterns inform how observers interpret a listing; they do not substitute for What's Publicly Reported about this specific case.

About fflawoffice

Friedman & Feiger is a law firm based in Dallas, Texas, with a reported headquarters at 5301 Spring Valley Road, Suite 200. Public descriptions characterize it as a results-oriented practice handling litigation and commercial transactions. Law firms of this type routinely manage client identities, case files, correspondence, contracts, billing records, and other materials that are privileged or confidential by nature. Even routine administrative systems can contain contact details, financial arrangements, and notes tied to ongoing or past matters.

A breach involving a legal practice is consequential because the data such firms hold is rarely generic. Clients entrust attorneys with information they would not share casually—details of disputes, business dealings, personal circumstances, and strategy. Staff and opposing parties may also appear in the same systems. When internal files are reported as exfiltrated, the circle of people who may be affected extends beyond the firm's own employees to anyone whose matters were documented there. Public material associated with this listing does not allege negligence as an established fact; it records the claim that a ransomware group obtained internal files.

What was likely exposed

The facts name the exposed material as internal files exfiltrated in a ransomware attack. No further breakdown—such as specific categories of documents, client lists, email archives, or financial ledgers—is provided in the available record. The number of people affected is unknown.

Organizations in the legal sector typically hold client intake information, case-related documents, correspondence, contracts, billing and payment data, employee records, and internal work product. Some of that material may be protected by attorney-client privilege or other confidentiality rules. None of those categories can be asserted as confirmed contents of this incident. Exact contents remain unconfirmed; only the general description of internal files and the attackers' claim are on the public record summarized here.

What's at stake

For individuals, the primary risks are misuse of personal or case-related information, unwanted contact, fraud attempts that reference real legal matters, and the broader loss of confidentiality around sensitive life or business events. Even without full public release, data that circulates among criminals can be used for targeted phishing, identity fraud, or pressure related to the substance of a legal dispute. Clients may also face uncertainty about whether privileged communications remain secure, which can affect trust and the conduct of ongoing matters.

For the firm, stakes include operational disruption if systems were encrypted, potential regulatory or professional obligations around notice and safeguarding, reputational harm, and the cost of investigation and remediation. Because the scale of any exposure is undisclosed, both the firm and potentially affected people are left working with incomplete information. That uncertainty itself is part of the harm: people cannot easily judge how urgently to act when the precise inventory of taken data has not been made public.

What to do if you're exposed

If you are a client, former client, employee, or other party who has dealt with Friedman & Feiger, treat the listing as a reason for heightened caution rather than proof that your specific file was taken. Watch for unexpected messages that reference legal matters, invoices, or personal details you have shared with counsel; verify any such contact through known firm channels rather than links or numbers supplied in unsolicited mail. Consider placing fraud alerts with major credit bureaus if financial identifiers could have been involved, and review account statements for unfamiliar activity. Preserve any notices you receive from the firm and follow official guidance if the firm issues one.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach datasets elsewhere. That step does not confirm or rule out involvement in this incident, but it can surface credentials or personal data that have circulated from other sources and that criminals sometimes combine with fresh leaks. Keep records of any steps you take, and seek advice from qualified professionals if you believe highly sensitive legal or financial information may be at risk.

AICompiled with AI assistance from public sources and published under our editorial standards.