Lorber, Greenfield & Polito, LLP Listed by qilin Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to pressure professional-services firms by listing them on dark-web leak sites, often before any independent confirmation of compromise. In this environment, a single listing can signal that internal files have been taken and may be published unless a ransom is paid. On 28 October 2025, Lorber, Greenfield & Polito, LLP appeared on the qilin ransomware group’s leak site. The group claims to have stolen internal data; the number of people affected remains unknown, and public detail about the precise contents of the files is limited. For clients, staff and counterparties of a law firm, any such claim raises immediate questions about the confidentiality of legal work and personal information.

What follows is a factual account of the known listing, the actor involved, the firm’s sector, and the practical implications for those who may be affected. No assumption is made that the firm was negligent; the record consists solely of the public claim and the limited details released with it.

What happened

According to the available record, Lorber, Greenfield & Polito, LLP was listed on the qilin ransomware leak site on or about 28 October 2025. The group states that it exfiltrated internal files in a ransomware attack and claims to have stolen internal data. No further technical details—such as the initial access method, the duration of any intrusion, the volume of data taken, or whether encryption was also deployed—have been disclosed in the public summary. The number of individuals whose information may be involved is listed as unknown. Independent verification of the group’s assertions has not been reported, so the listing itself remains an unverified claim by the threat actor.

Who is qilin?

Qilin is a ransomware operation that has been publicly documented since approximately 2022, often operating under a ransomware-as-a-service model. Like many contemporary groups, it typically employs double-extortion tactics: after gaining access to a network, operators encrypt systems and simultaneously copy data, then threaten to publish the stolen material on a dedicated leak site if payment is not received. Public reporting on prior campaigns shows that qilin has targeted organisations across multiple sectors, including professional services, manufacturing and healthcare, and has used common initial-access techniques such as phishing, exploitation of remote-access tools and compromised credentials. The group maintains a leak site where it posts victim names and, in some cases, sample files to increase pressure. In the present matter the only specific claim attributable to qilin is that it stole internal data from Lorber, Greenfield & Polito, LLP; no additional statements by the group about this particular victim have been recorded in the facts.

Lorber, Greenfield & Polito, LLP and its sector

Lorber, Greenfield & Polito, LLP is a law firm organised as a limited-liability partnership. Firms of this type routinely handle confidential client matters, litigation files, contracts, correspondence, financial records and personal data belonging to individuals and businesses. Because legal work depends on privilege and confidentiality, any unauthorised access to internal systems carries heightened sensitivity. A ransomware listing against such an organisation is consequential precisely because the data held is often unique, time-sensitive and subject to professional and regulatory duties of protection. Public detail about the firm’s size, practice areas or technology environment is not supplied in the breach record, so those aspects remain outside the scope of this account.

What was likely exposed

The facts state only that internal files were exfiltrated in a ransomware attack and that the group claims to have stolen internal data. No inventory of specific data types—such as client names, Social Security numbers, bank details, medical information or privileged communications—has been released. Organisations of this kind typically maintain case files, engagement letters, billing records, employee personnel data and correspondence that may contain personally identifiable information. Because the exact contents remain unconfirmed, it is not possible to state with certainty what was taken. Readers should treat any assertion about particular categories of data as speculative until official notification or independent analysis is available.

The real-world impact

If the group’s claim is accurate, affected individuals could face risks that include identity theft, targeted phishing that references genuine legal matters, or exposure of sensitive personal or commercial information. For the firm itself, the consequences may include regulatory notification obligations, potential civil claims, reputational harm and the operational cost of investigation and remediation. Because the number of people affected is unknown and the precise data types are undisclosed, the scale of these risks cannot yet be quantified. Even when files are not immediately published, the mere existence of a leak-site listing can create prolonged uncertainty for clients and staff who must decide whether to take protective steps.

Were you affected?

If you are a current or former client, employee or business partner of Lorber, Greenfield & Polito, LLP, monitor official communications from the firm for any breach notification. In the meantime, consider placing a fraud alert with the major credit bureaus, reviewing recent account statements for unusual activity, and changing passwords on any accounts that may have been linked to the firm. You can also run a free exposure scan of your email address to check whether your information has already appeared in known breach data sets. These steps do not confirm or deny involvement in this specific incident, but they provide a practical starting point while further details remain limited.

AICompiled with AI assistance from public sources and published under our editorial standards.