Milberg Listed by sarcoma Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to single out professional-services firms that hold large volumes of confidential client material, turning law practices into high-value targets in the current threat landscape. On 8 July 2025 the group known as sarcoma publicly listed Milberg on its leak site, asserting that it had carried out a ransomware attack and exfiltrated internal files.

The listing is significant because Milberg is itself a law firm that represents ransomware victims; any compromise therefore risks exposing both the firm’s own operations and information belonging to the clients it advises. Public detail remains limited, and the number of people affected is unknown.

Inside the incident

According to the information released on 8 July 2025, sarcoma claimed responsibility for a ransomware attack against Milberg that resulted in the exfiltration of internal files. The group’s leak-site entry presents the incident as a double-extortion event in which data was taken before encryption. No further technical details—such as the initial access vector, the precise date of intrusion, the volume of data removed, or confirmation of encryption—have been disclosed by either the group or the firm.

Sarcoma’s post also asserts that an archive contains data belonging to several law firms, including milberg.com together with thesandersfirm.com, aronovaassociates.com and sgafirm.com. These assertions remain unverified claims made by the threat actor. The number of individuals whose information may have been involved is listed as unknown, and no independent confirmation of the breach’s scope has been published.

Inside sarcoma

Sarcoma is a ransomware operation that follows the now-common double-extortion model: after gaining access to a network, the group steals data and then encrypts systems, threatening to publish the stolen material if a ransom is not paid. Like many contemporary ransomware crews, it maintains a public leak site where it names victims and, in some cases, releases sample files to pressure payment. Public reporting has documented sarcoma’s activity against organisations across multiple sectors, typically relying on standard initial-access methods such as phishing, exploitation of unpatched remote-access services, or compromised credentials. The group’s listing of Milberg is presented solely as its own claim; no independent verification of the technical details of this particular intrusion has been supplied.

About Milberg

Milberg is a law firm whose practice includes representation of organisations that have themselves been victims of ransomware. Firms of this type routinely handle highly sensitive material: client communications, litigation files, financial records, personal data of individuals involved in legal matters, and strategic advice on cyber-incident response. Because the firm’s work centres on ransomware cases, a successful intrusion carries an added layer of irony and potential reputational harm. Any unauthorised access to its systems could expose not only Milberg’s internal operations but also confidential information entrusted to it by clients who turned to the firm precisely because they had already suffered cyber attacks.

What was likely exposed

The only data type explicitly named in the available facts is “internal files exfiltrated in ransomware attack.” No inventory of specific file categories, record counts, or data fields has been released. Law firms of Milberg’s profile typically store client contracts, correspondence, discovery materials, personal identifiers of parties to litigation, billing records and internal work product. Whether any of those categories were among the files claimed by sarcoma remains unconfirmed. The group’s assertion that the archive also contains material from other named law firms is likewise an unverified claim. Exact contents of the alleged exfiltration are therefore unknown.

The real-world impact

For individuals whose information may have been held by Milberg, the principal risks are identity theft, targeted phishing, and unauthorised use of personal or financial details that could appear in legal files. Clients of the firm—many of whom are already recovering from their own ransomware incidents—face the additional possibility that sensitive case strategy or proprietary business data could be disclosed. For the firm itself, the consequences include potential regulatory notification obligations, loss of client confidence, and the operational cost of investigation and remediation. Because the number of affected people is unknown and the precise data set is unconfirmed, the full scale of harm cannot yet be quantified; the risks, however, are concrete and long-lasting once confidential legal material leaves controlled systems.

If your data was in this claimed breach

If you have reason to believe your information was held by Milberg or any of the other firms named in the group’s claim, begin by monitoring financial accounts and credit reports for unusual activity. Enable multi-factor authentication on email and other critical accounts, and treat unsolicited messages that reference legal matters with heightened caution. Consider placing fraud alerts with major credit bureaus. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets; such a scan provides an early indicator of whether personal credentials or contact details have circulated more widely.

AICompiled with AI assistance from public sources and published under our editorial standards.