Matthews Law Listed by medusa Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Matthews Law, a small New Zealand law firm, has been listed by the medusa ransomware group as a victim of a data-exfiltration attack. Public reporting of the listing dates to 22 April 2025. The number of people affected remains unknown, and the only detail released so far is that internal files were taken.

Because the firm handles legal and conflict-resolution matters, any exposure of client or case material carries real consequences for the individuals and organisations it represents. At present the claim rests on the group’s leak-site listing; independent confirmation of the full scope has not been published.

Inside the incident

According to the available record, Matthews Law was named on medusa’s leak site in connection with a ransomware attack that involved the exfiltration of internal files. The report was dated 22 April 2025. No further technical details—such as the initial access vector, the exact date of intrusion, the volume of data removed, or whether encryption was also deployed—have been disclosed publicly.

The number of individuals whose information may be involved is listed as unknown. The firm’s size (approximately ten employees) and its Auckland location are the only organisational facts supplied in the public summary. Beyond the assertion that internal files left the network, the concrete contents of the stolen material remain unconfirmed.

Who is medusa?

Medusa is a well-documented ransomware operation that has operated under a ransomware-as-a-service model. The group typically gains access to corporate networks, exfiltrates data, and then encrypts systems while threatening to publish the stolen material if a ransom is not paid. Its leak site is used both to pressure victims and to advertise successful attacks to other potential targets.

Public reporting over recent years has associated medusa with attacks across multiple sectors, including professional services. The group’s standard practice is to list a victim’s name and claim that data has been taken; such listings are claims until corroborated by the victim organisation or independent forensic evidence. In this case the listing of Matthews Law is presented exactly as that—an unverified claim by the group.

About Matthews Law

Matthews Law is a New Zealand law firm that also offers conflict-resolution services. Its corporate office is recorded at 48 Shortland Street, Auckland 1010, and the firm is described as having roughly ten employees. Law firms of this type routinely hold confidential client files, correspondence, contracts, personal identification documents, financial records, and sensitive dispute-resolution materials.

Even a modest practice can accumulate years of privileged information. A breach at such an organisation therefore raises concerns that go beyond ordinary commercial data loss: legal privilege, client confidentiality, and the integrity of ongoing or past matters may all be implicated. Public detail on whether any of those categories were actually taken remains limited.

The information in question

The only data type named in the public record is “internal files exfiltrated in ransomware attack.” No inventory of file names, client lists, or specific document categories has been released. Organisations of this kind typically store client personal data, case files, billing records, employee information, and internal correspondence. Whether any of those materials were among the files claimed by medusa has not been confirmed.

Until a fuller disclosure or forensic report appears, the precise contents of the exfiltrated data must be treated as unconfirmed. Readers should not assume that particular categories of information were or were not involved solely on the basis of the group’s listing.

What's at stake

For individuals whose details may appear in the firm’s files, the practical risks include identity misuse, targeted phishing that references genuine legal matters, and the unwanted disclosure of private disputes or financial arrangements. Because legal files often contain highly personal or commercially sensitive material, the impact can extend to reputation, ongoing litigation, or settlement negotiations.

For Matthews Law itself the consequences include potential regulatory scrutiny under New Zealand privacy law, loss of client trust, and the operational cost of investigation and remediation. The firm’s small size does not diminish these risks; it may simply mean fewer resources are available to manage them. At this stage the scale of any actual harm remains unknown because the number of affected people and the exact data types have not been established.

If your data was in this claimed breach

If you have been a client of Matthews Law or have reason to believe your information was held by the firm, the following steps are prudent while further details emerge:

• Monitor bank and credit accounts for unexpected activity and consider placing a fraud alert with credit-reporting agencies.
• Treat any unsolicited contact that references legal matters or the firm with caution; verify identities through known official channels before responding.
• Change passwords on email and other accounts that may have been used in correspondence with the firm, and enable multi-factor authentication where available.
• Retain any formal notification you receive from the firm and follow the specific advice it contains.
• Run a free exposure scan of your email address against known breach data sets to check whether your details have already appeared in public dumps.

Public information about this incident is still limited. Further official statements from Matthews Law or New Zealand authorities, if they appear, will provide the most reliable guidance on next steps.

AICompiled with AI assistance from public sources and published under our editorial standards.