Horwitz Horwitz & Associates Listed by unsafe Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On December 21, 2022, Horwitz Horwitz & Associates, a United States-based firm, was listed by the ransomware group known as unsafe. Public reporting states that internal files were exfiltrated in a ransomware attack. The number of people affected remains unknown, and many operational details of the incident have not been disclosed.

A listing on a ransomware group's leak site is a claim by that group, not an independent confirmation of every asserted detail. Still, any confirmed or claimed exfiltration of internal files from a professional services firm raises clear questions for clients, employees, and partners about what may have left the organisation's control.

Inside the incident

According to the available record, Horwitz Horwitz & Associates appeared on unsafe's listings on or about December 21, 2022. The reported summary places the organisation in the United States and notes revenue on the order of 8.00 million dollars. The facts state that internal files were exfiltrated in a ransomware attack. No public figure has been given for the number of individuals affected. The precise method of initial access, the duration of any intrusion, the full scope of systems touched, and whether encryption was also deployed alongside theft are not detailed in the disclosed material. Timing beyond the reporting date, file volumes, and any ransom demand or negotiation outcome likewise remain undisclosed.

In short, the concrete public core is limited: a U.S. firm of that name was claimed by unsafe as a victim, with internal files described as having been taken. Everything else about scale and technique is unconfirmed in the record provided.

Inside unsafe

unsafe is known publicly as a ransomware operation that has listed organisations on leak sites after claiming to have stolen data. Like other groups in this category, it typically combines data theft with pressure tactics: victims are named, samples or descriptions of stolen material may be teased, and full publication is threatened if demands are not met. Public reporting on such actors over time has described double-extortion patterns—encryption of systems paired with exfiltration—so that even organisations with strong backups still face leverage from the stolen copy.

For this specific case, the facts support only that unsafe listed Horwitz Horwitz & Associates and that internal files were described as exfiltrated. No further statements attributed to the group about this victim—such as particular file names, client identities, or dollar demands—are included in the given record. Any broader claims on a leak site should be treated as the group's assertions until corroborated by the organisation or by independent investigation.

Who is Horwitz Horwitz & Associates?

Horwitz Horwitz & Associates is identified in the breach record as a U.S. organisation with reported revenue around 8.00 million dollars. Firms operating under similar professional-services names commonly work in legal or related advisory fields, handling client matters, case files, correspondence, and internal business records. Such organisations routinely hold sensitive personal and financial information belonging to clients and staff, along with privileged or confidential work product.

A breach or claimed exfiltration at this type of firm is consequential because the data involved is often not easily rotated or cancelled the way a single password might be. Clients may have shared medical details, accident histories, financial circumstances, or other private facts in the course of seeking representation or advice. Employees' personnel data and the firm's own contracts, emails, and operational documents can also sit in the same environment. Even when the exact contents of a theft remain unconfirmed, the sector's typical data holdings explain why listings of this kind draw attention.

The information in question

The facts name the exposed material as internal files exfiltrated in a ransomware attack. No further breakdown—such as whether client databases, email archives, financial ledgers, or employee records were included—is provided. The number of people affected is unknown.

Organisations of this kind typically maintain client intake forms, case-related documents, billing and payment information, internal memoranda, and human-resources files. It is reasonable to expect that some mix of those categories could exist inside a professional firm's systems. It is not reasonable, on the present record, to state that any specific category was definitively taken. Exact contents remain unconfirmed; only the general description "internal files" is given.

The real-world impact

For individuals whose information may have been among internal files, risks are practical rather than abstract. Stolen personal data can be used in targeted phishing, identity fraud, or social-engineering attempts that reference real case or account details. Financial or contact information, if present, can support account-takeover or scam activity. Because the count of affected people is unknown and the file inventory is not public, people connected to the firm cannot yet know from open sources whether they are included.

For the organisation, consequences can include regulatory notification duties, contractual obligations to clients, forensic and recovery costs, and reputational harm. Ransomware incidents also disrupt normal operations while systems are examined and restored. None of these outcomes require assuming negligence; they follow from the simple fact that internal material is claimed to have left the environment. Until the firm or investigators publish a fuller accounting, the precise severity for any one person or for the business as a whole stays partly opaque.

What to do if you're exposed

If you are a client, employee, or partner of Horwitz Horwitz & Associates, treat the listing as a reason for heightened caution even while details remain limited. Practical first steps include:

• Monitor account statements and credit reports for unfamiliar activity and consider a fraud alert if you have shared sensitive personal data with the firm.
• Be skeptical of unexpected emails, calls, or messages that reference legal matters, payments, or personal details; verify through known official channels before responding or clicking.
• Change passwords on related accounts, especially if you reused credentials, and enable multi-factor authentication where available.
• Retain any notice the firm may send; it may confirm what was involved and what support is offered.
• Run a free exposure scan of your email addresses to check whether your information has already surfaced in known breach datasets elsewhere.

Public detail on this incident is limited to the December 21, 2022 listing by unsafe, the U.S. location and revenue note, and the description of internal files exfiltrated in a ransomware attack. Further clarity depends on official updates from the organisation or from regulators. Until then, calm monitoring and basic hygiene remain the most useful responses.

AICompiled with AI assistance from public sources and published under our editorial standards.