Goodfellow & Schuettlaw Listed by anubis Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On October 23, 2025, the law firm Goodfellow & Schuettlaw was listed by the ransomware group known as anubis. Public reporting indicates that internal files were exfiltrated in a ransomware attack, with the group claiming the material includes personal data, confidential documents, and more. The number of people affected remains unknown, and many operational details of the incident have not been disclosed.

For clients, staff, and anyone whose information may have been held by the firm, the listing raises concrete questions about what was taken and how it might be used. What is known so far is limited to the group’s claim and the reported summary; independent confirmation of the full scope has not been made public.

Inside the incident

According to available reports, Goodfellow & Schuettlaw was listed by anubis on or around October 23, 2025. The incident is described as a ransomware attack in which internal files were allegedly exfiltrated. The reported summary states that the material includes personal data, confidential documents, and more. No public figure has been given for the number of individuals affected, and details such as the precise method of initial access, the duration of unauthorized presence on systems, or the total volume of data taken have not been disclosed.

Because the primary public signal is the group’s leak-site listing, the claim that data was stolen and is being held for leverage should be treated as an assertion by the actors rather than as independently verified fact at this stage. No further technical indicators or official statements expanding on the timeline have been included in the public record used for this account.

The group behind it: anubis

Anubis is a ransomware operation that has appeared in public threat reporting as a group that deploys encryption malware and engages in double-extortion tactics. In such campaigns, operators typically claim to have copied data before locking systems, then threaten to publish or sell the material if a ransom is not paid. Listings on dedicated leak sites are a standard pressure mechanism used by many ransomware groups, including anubis.

Public documentation of anubis activity describes the group as opportunistic in target selection and focused on organizations that hold sensitive or regulated information. The group’s claims about any specific victim, including Goodfellow & Schuettlaw, remain claims until corroborated by the victim organization, law enforcement, or independent forensic reporting. No statements attributed to anubis beyond the listing itself are part of the facts available for this incident.

Who is Goodfellow & Schuettlaw?

Goodfellow & Schuettlaw is a law firm. Firms of this type routinely handle client matters that involve personal identifiers, financial records, correspondence, contracts, litigation files, and other confidential material. Legal practices often store data subject to professional secrecy rules and, depending on jurisdiction and practice area, may also hold information covered by privacy or data-protection statutes.

A breach affecting a law firm is consequential because the data typically held is both sensitive and long-lived. Clients entrust firms with information they would not share publicly; staff and opposing parties may also appear in the same systems. Even when the exact contents of a given incident remain unconfirmed, the nature of the sector means any confirmed exfiltration can create lasting exposure for the people whose records were involved.

The information in question

The facts available name the exposed material as internal files exfiltrated in a ransomware attack. The reported summary describes personal data, confidential documents, and more. No exhaustive inventory of file types, record counts, or specific data elements has been published in the source material.

Organizations in the legal sector commonly maintain client contact details, case files, billing records, identity documents, and privileged communications. Whether any or all of those categories were present in the files claimed by anubis has not been independently confirmed. Readers should treat the group’s description as an unverified claim and avoid assuming that particular documents or personal records have been proven to be among the material taken.

Why it matters

For individuals whose data may have been held by the firm, the practical risks include identity misuse, targeted phishing that references real case or personal details, and the long-term circulation of confidential information. Even partial records can be combined with other breaches to build fuller profiles. For the firm itself, the incident raises issues of client trust, regulatory notification duties where applicable, and the operational cost of investigation and remediation.

Because the number of people affected is unknown and the precise contents remain unconfirmed, the scale of individual harm cannot yet be quantified. The absence of public detail does not eliminate risk; it simply means affected parties must proceed on the basis of caution rather than a complete inventory.

What to do if you're exposed

If you have been a client, employee, or other contact of Goodfellow & Schuettlaw, treat the possibility of exposure seriously until more is known. Practical first steps include:

• Monitor financial and credit accounts for unexpected activity and consider placing fraud alerts where available.
• Be alert to phishing or social-engineering attempts that reference legal matters, personal details, or the firm’s name.
• Change passwords on accounts that may have shared credentials or recovery information with the firm, and enable multi-factor authentication where possible.
• Retain any official notices the firm may issue and follow guidance from relevant authorities or regulators in your jurisdiction.
• Run a free exposure scan of your email address to check whether your information has already appeared in known breach data sets.

Public detail on this incident remains limited. Further clarity will depend on statements from the firm, law-enforcement updates, or independent analysis. Until then, measured vigilance is the most useful response.

AICompiled with AI assistance from public sources and published under our editorial standards.