Khatami Law Listed by qilin Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On October 19, 2025, the law firm Khatami Law was listed by the ransomware group known as qilin, which claimed to have carried out a ransomware attack involving the exfiltration of internal files. Public reporting does not confirm the number of people affected or provide further verified details on the scale or method of the incident. For clients and others whose information may have been held by the firm, the listing raises questions about potential exposure of sensitive legal and personal records, even as exact confirmation remains limited.

This account draws only on the available facts of the listing and established public knowledge of the actors and sector involved. Where specifics are undisclosed, that limitation is stated plainly.

What happened

According to the reported facts, Khatami Law was listed by the qilin ransomware group on or around October 19, 2025. The group claims the listing relates to a ransomware attack in which internal files were exfiltrated. No further public details have been provided on the timing of the intrusion itself, the technical method used, the volume of data taken, or whether systems were encrypted in addition to the claimed exfiltration. The number of people affected is listed as unknown. The listing on the group's site constitutes a claim by qilin and has not been independently confirmed in the available record as an established fact of compromise.

Who is qilin?

Qilin is a ransomware group that has operated as a ransomware-as-a-service operation, typically employing double-extortion tactics. In this model, operators encrypt victim systems while also exfiltrating data and threatening to publish it on a leak site if a ransom is not paid. Public reporting on the group has documented its activity against organizations across multiple sectors, often involving the theft of internal documents, credentials, and other business records before or alongside encryption. The group has been observed using established ransomware tooling and affiliate models common to this class of threat actors. With respect to Khatami Law specifically, the only claim on record is the listing itself asserting that internal files were exfiltrated; no additional statements by the group about this victim are included in the facts.

Who is Khatami Law?

Khatami Law is identified in the available record as a law firm. Public detail on its precise size, locations, or practice areas is limited in the breach reporting. Law firms of this type generally handle client matters that can include personal injury, family law, or related civil work and therefore routinely hold confidential client files, correspondence, financial records, medical or accident documentation, and personal identifiers. A reported summary associated with the incident describes a firm focused on personal injury and family law services for clients in the Sacramento area and surrounding regions, with an emphasis on compensation for accident victims. Whether that description applies exactly to Khatami Law or reflects related public information remains unconfirmed in the facts provided. In any case, organizations in the legal sector are attractive targets because the data they maintain is both sensitive and often difficult to replace or revoke once disclosed.

What was likely exposed

The facts state that internal files were exfiltrated in a ransomware attack. No more granular inventory of data types—such as specific categories of client records, employee information, financial documents, or communications—has been disclosed. For a law firm, internal files typically encompass case files, client intake forms, correspondence, billing records, and other materials containing personal and confidential information. Because the exact contents remain unconfirmed, it is not possible to state with certainty what was taken. Readers should treat any assumption about particular data elements as speculative until further verified information appears.

Why it matters

If internal files from a law firm are exposed, the practical risks for affected individuals include identity theft, targeted fraud, or the misuse of sensitive personal and legal details. Clients may face embarrassment, reputational harm, or complications in ongoing legal matters if confidential information surfaces. For the firm itself, the incident can disrupt operations, create regulatory or ethical obligations around client notification, and erode trust. Because the number of people affected is unknown and the precise data set is undisclosed, the full scope of impact cannot yet be measured. Even limited exposure of legal files can have lasting consequences given the nature of the information such organizations hold.

If your data was in this claimed breach

Individuals who have been clients of or otherwise dealt with Khatami Law should monitor financial accounts and credit reports for unusual activity and consider placing fraud alerts if they believe their information may have been involved. Changing passwords on any accounts that reused credentials associated with the firm is a prudent step. Because public confirmation of affected individuals is unavailable, those concerned can also run a free exposure scan of their email address to check whether their information has already appeared in known breach data sets. Official notifications, if any are issued by the firm or regulators, should be treated as the authoritative source for next steps.

AICompiled with AI assistance from public sources and published under our editorial standards.