Hall Booth Smith Listed by blackbasta Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On March 8, 2023, the law firm Hall Booth Smith appeared on a listing associated with the blackbasta ransomware group. Public detail is limited: the number of people affected remains unknown, and the only description of what was taken refers to internal files said to have been exfiltrated in a ransomware attack. For clients, employees, opposing parties, and others whose information may sit in a firm’s systems, that kind of claim raises immediate practical questions about whether personal or confidential material has left the organisation’s control and what risks follow.

Because law firms routinely hold sensitive records, even an unverified listing matters. This article sets out only what has been reported, places the claim in the context of how blackbasta typically operates, and outlines concrete steps people can take if they believe they may be affected.

Inside the incident

According to the available record, Hall Booth Smith was listed by the blackbasta ransomware group on or about March 8, 2023. The report describes the incident as a ransomware attack in which internal files were allegedly exfiltrated. No public figure has been given for the number of individuals affected. No detailed inventory of file names, systems, or exact data categories beyond “internal files” has been disclosed in the facts provided. Timing of the intrusion itself, the initial access method, and any ransom demand or negotiation are likewise undisclosed.

The listing on a ransomware group’s leak site is a claim by that group. It has not been independently confirmed in the material at hand, and readers should treat it as an assertion rather than established fact until the firm or other authoritative sources provide further verification. What is known is simply that the organisation’s name appeared in connection with blackbasta and that the described impact centres on exfiltration of internal files during a ransomware event.

Who is blackbasta?

Blackbasta is a ransomware operation that became widely documented in public reporting from 2022 onward. Like many contemporary ransomware groups, it has commonly used a double-extortion model: encrypting systems to disrupt operations while also copying data and threatening to publish or sell it if a ransom is not paid. The group has maintained a leak site on which it names organisations it claims to have compromised and, in some cases, posts samples or larger sets of stolen data.

Public analyses of blackbasta activity have described targeting across multiple sectors and geographies, often through initial access methods such as compromised credentials, phishing, or exploitation of exposed services, followed by lateral movement and deployment of ransomware. The group’s listings are marketing and pressure tools; they do not by themselves prove the full scope of any single incident. For this article, no statements attributed specifically to blackbasta about Hall Booth Smith beyond the fact of the listing and the general description of internal-file exfiltration are treated as confirmed.

Hall Booth Smith and its sector

Hall Booth Smith, P.C. (HBS) is a full-service law firm established in 1989. Public descriptions place its offices across multiple states, including several locations in Georgia as well as offices in Alabama, South Carolina, North Carolina, Florida, Tennessee, Arkansas, Montana, Colorado, Oklahoma, New Jersey, and New York. As a multi-office practice, it handles legal work that typically involves client communications, case files, contracts, discovery materials, and related administrative records.

Law firms occupy a high-trust position in the handling of other people’s information. They routinely receive personally identifiable information, financial details, health-related records in certain practice areas, corporate secrets, litigation strategy, and correspondence that parties expect to remain confidential. A ransomware incident affecting such an organisation is consequential not only because of potential operational disruption inside the firm, but because third-party data—belonging to clients, employees, witnesses, or counterparties—may be among the materials at risk. The sector’s reliance on email, document management systems, and remote access also makes firms recurring targets for criminal groups seeking leverage.

What was likely exposed

The facts name the exposed material only as “internal files exfiltrated in [a] ransomware attack.” No further breakdown—such as whether client matter files, human-resources records, email archives, or financial systems were involved—has been disclosed. The number of people affected is unknown. Therefore any description of precise contents remains unconfirmed.

Organisations of this type typically hold a range of sensitive information. Without confirmation that any particular category was taken in this incident, the following reflects only what law firms commonly maintain, not what has been proven here:

• Client identification and contact details
• Case files, pleadings, discovery, and legal memoranda
• Contracts, corporate records, and privileged correspondence
• Employee and applicant personal data
• Billing, trust-account, and other financial records

Until Hall Booth Smith or another authoritative source publishes a verified inventory, it is not possible to state which of these, if any, left the firm’s control.

Why it matters

For individuals, the core risk is misuse of personal or confidential information if it was among the exfiltrated files. That can include targeted phishing that references real legal matters, identity theft, or exposure of private details that were shared only with counsel. Even when data is not immediately published, the fact that a criminal group claims to hold it creates ongoing uncertainty. For the firm, consequences can include operational downtime from encryption, regulatory and ethical obligations to assess and notify affected parties, reputational harm, and the cost of investigation and remediation. None of these outcomes require assuming negligence; they follow from the nature of the data law firms hold and the tactics ransomware groups use.

Because the scale and exact contents remain undisclosed, people who have had a relationship with Hall Booth Smith—as clients, employees, or otherwise—cannot yet know from public sources alone whether their information was involved. That uncertainty itself is a reason for measured vigilance rather than panic.

What to do if you're exposed

If you have reason to believe your data may have been held by Hall Booth Smith, practical first steps are straightforward. Monitor account statements and credit reports for unfamiliar activity. Treat unexpected emails or calls that reference legal matters or personal details with caution, and verify them through known channels rather than links or numbers supplied in the message. Consider placing fraud alerts or credit freezes with the major consumer reporting agencies if you see signs of misuse. If the firm issues official notification or guidance, follow the instructions it provides, including any offer of credit monitoring.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach datasets. That check does not confirm or rule out involvement in this specific incident, but it can indicate whether your address has surfaced elsewhere and help you prioritise password changes and monitoring. Keep records of any suspicious contact, and report clear evidence of identity theft to the relevant authorities. Public detail on this incident remains limited; staying alert to official updates from the firm is the most reliable way to learn whether your information was affected.

AICompiled with AI assistance from public sources and published under our editorial standards.