Glovers Solicitors LLP Listed by alphv Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups have spent recent years treating professional-services firms as high-value targets, knowing that legal practices hold concentrated volumes of sensitive client and commercial material and often face intense pressure to restore operations quickly. Against that backdrop, the listing of a London property law firm on a ransomware leak site in early 2023 fits a familiar pattern of claims, pressure and limited public detail.

On 23 February 2023, Glovers Solicitors LLP was reported as listed by the alphv ransomware group. Public reporting indicates that internal files were exfiltrated in a ransomware attack. The number of people affected remains unknown, and fuller technical particulars have not been disclosed. For clients, counterparties and staff connected to a property-focused practice, even an unverified claim of data theft raises practical questions about confidentiality and follow-up.

Inside the incident

According to the available record, Glovers Solicitors LLP appeared on an alphv-associated listing dated 23 February 2023. The reported summary of the incident states that internal files were exfiltrated in a ransomware attack. No confirmed figure for individuals affected has been published, and public detail does not describe the initial access method, the duration of any intrusion, whether encryption was deployed alongside theft, or any negotiation or recovery timeline.

Because the primary public signal is the group’s listing itself, the claim that data was taken should be treated as an assertion by the threat actor rather than as independently verified fact in open sources. Organisations in this position commonly investigate, contain systems and assess what, if anything, left the network; those steps are not detailed in the material available here. Scale, exact file inventories and confirmation of impact on specific clients or matters therefore remain undisclosed.

The group behind it: alphv

Alphv, also widely known in public reporting as BlackCat, emerged as a prominent ransomware operation in the early 2020s. It has operated in a ransomware-as-a-service model, in which affiliates conduct intrusions and deploy the group’s tooling in exchange for a share of proceeds. Public technical and law-enforcement reporting has associated the group with double-extortion tactics: encrypting systems where possible while also stealing data and threatening to publish it on a dedicated leak site if demands are not met.

The group has been linked to attacks across multiple sectors and geographies, often emphasising speed of encryption, customisable payloads and pressure campaigns that include naming victims online. Listings on such sites function as both a threat and a marketing signal to other criminals; they do not, by themselves, prove the full scope of any single incident. In this case, alphv’s listing of Glovers Solicitors LLP is the reported claim; no additional statements by the group about this victim beyond that listing are included in the facts at hand.

About Glovers Solicitors LLP

Glovers Solicitors LLP is a property-focused legal practice with roots dating to 1932, when it was founded as Glover & Co in Mayfair by Sir Gerald Glover. The firm later established itself in Covent Garden and describes itself as a modern, partner-led practice recognised for depth in its chosen property-related areas. Clients, according to the firm’s own characterisation, value legal expertise alongside a commercial approach to negotiations and problem-solving.

Law firms of this type routinely handle matters involving real-estate transactions, development, landlord-and-tenant issues and related commercial work. That work typically requires holding identity documents, financial and contractual records, correspondence, and other confidential material belonging to individuals and corporate clients. A ransomware incident affecting such a practice is consequential because the confidentiality of client matters is central to the solicitor–client relationship and to the firm’s professional obligations, and because disruption can delay transactions and advice that depend on timely access to systems and files.

What was likely exposed

The facts name the exposed material only in general terms: internal files exfiltrated in a ransomware attack. No inventory of document types, no count of records, and no confirmation of whether client files, staff data, emails or financial systems were included has been published in the material provided.

Organisations in the property-law sector commonly hold client identification and know-your-client records, contracts and title-related documents, bank and payment details tied to transactions, internal emails, matter files and administrative records. It is reasonable to expect that a theft of “internal files” could touch some of that category of information, but it is not established as fact which systems or folders were taken. Exact contents remain unconfirmed; anyone who has been a client or counterparty should treat exposure as possible rather than proven until the firm or official notices say otherwise.

What's at stake

For individuals, the practical risks centre on misuse of personal or financial details if they were among any stolen files—identity fraud, targeted phishing that references real property matters, or attempts to socially engineer banks or other professionals. For corporate clients, leaked contracts, pricing, dispute strategy or development plans could create commercial disadvantage or embarrassment even when no payment-card data is involved.

For the firm, stakes include operational disruption, regulatory and professional-duty scrutiny, notification obligations where personal data is confirmed compromised, and longer-term trust with clients who expect confidentiality. Because the number of people affected is unknown and the file set is not publicly itemised, the concrete impact cannot be sized from open reporting alone. The prudent stance is to assume elevated risk until clearer information emerges, without treating every contact of the firm as confirmed compromised.

What to do if you're exposed

If you have been a client, employee or regular counterparty of Glovers Solicitors LLP, watch for formal notices from the firm or from regulators; those remain the authoritative source on whether your data was involved. In parallel, tighten account security on email and financial services you use—unique passwords and multi-factor authentication reduce the value of any leaked credentials—and treat unexpected messages that reference property deals, invoices or legal matters with caution, verifying through known channels before acting.

Monitor bank and credit activity for unfamiliar applications or transactions, and consider fraud alerts if you believe identity documents may have been held on file. You can also run a free exposure scan of your email address to check whether it has already appeared in known breach datasets, which helps prioritise further monitoring even when a specific incident’s full contents stay undisclosed.

AICompiled with AI assistance from public sources and published under our editorial standards.