Law Offices of Brandon Sua & Associates Listed by everest Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
The Law Offices of Brandon Sua & Associates Listed by everest Ransomware Group (reported March 7, 2022) is an unverified claim; the data involved is undisclosed belonging to roughly unknown people. If you have an account with them, your information may now be circulating on the open web and with data brokers. Here’s exactly what happened, how to check if you were affected, and what to do next.
What happened
The incident was first noted publicly when the organization was added to the Everest ransomware group’s leak site on March 7, 2022. The group claims to have exfiltrated internal files in connection with a ransomware attack. No further details on the timing of the intrusion, the method of access, the volume of data, or any ransom demand have been made public. The number of people whose information may be involved is also unknown.
Who is everest?
Everest is a ransomware operation that has been publicly active since at least 2020. Like several other groups of its kind, it employs a double-extortion approach: it encrypts systems and also removes copies of data, then threatens to publish the stolen material on a dedicated leak site if a ransom is not paid. The group has listed organizations from multiple sectors on its site, presenting each listing as evidence of a successful operation. Any specific claim about a victim originates from the group itself and is not independently verified in public reporting.
About Law Offices of Brandon Sua & Associates
Law Offices of Brandon Sua & Associates is a legal practice. Firms of this type routinely maintain records that include client identities, case details, correspondence, financial arrangements, and other documents generated during legal representation. Because these records often contain information that is both personal and protected by professional confidentiality obligations, any unauthorized access carries implications beyond typical commercial data loss.
What was likely exposed
The only detail released is that internal files were allegedly exfiltrated. The exact categories of information contained in those files have not been disclosed. Organizations in the legal sector commonly store client names, addresses, identification numbers, financial data, medical or employment records referenced in cases, and privileged communications. Without a confirmed inventory, it is not possible to state which of these data types, if any, were taken in this incident.
Why it matters
Legal practices hold information that can be used for identity-related fraud, targeted scams, or interference in ongoing matters. When such data appears on a public leak site, affected individuals lose control over how and when their details may circulate. For the firm, the event creates potential regulatory, contractual, and reputational obligations even when the full scope of exposure remains unclear.
If your data was in this claimed breach
Individuals who believe their information may have been held by the firm should monitor their financial accounts and credit reports for unusual activity. Changing passwords for any accounts linked to the firm and enabling multi-factor authentication where available are standard first steps. Readers can also run a free exposure scan of their email address against known breach data sets to check for prior appearances of their information.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
XEFI / Neocyber Listed by everest Ransomware GroupGreenberg & Stein New York City Personal Injury Lawyers Listed by everest Ransomware GroupStudio Marchi - Studio Professionale Associato Listed by everest Ransomware GroupMorgan Records Management Listed by everest Ransomware GroupLatest breaches
Publicly posted by everest — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.