Miller & Caggiano Listed by dragonforce Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target professional services firms that hold sensitive client records, turning internal systems into leverage for extortion. In this landscape, listings on criminal leak sites often surface before independent confirmation, leaving organizations and individuals to assess risk from incomplete public information.

On April 09, 2025, Miller & Caggiano was listed by the dragonforce ransomware group. Public reporting describes the incident as involving the exfiltration of internal files in a ransomware attack. The number of people affected remains unknown, and further technical details have not been disclosed. The listing itself is a claim by the group; independent verification of the full scope has not been established in available records.

Breaking down the breach

According to the available facts, Miller & Caggiano appeared on a dragonforce leak-site listing dated April 09, 2025. The reported summary states that internal files were exfiltrated in a ransomware attack. No public figures have been given for the volume of data, the precise date of intrusion, the initial access method, or any ransom demand. The number of individuals potentially affected is listed as unknown. Beyond the claim of internal-file exfiltration, the facts provide no further technical breakdown of the incident.

Because the listing originates from the threat actor, it should be treated as an unverified claim until corroborated by the firm or independent investigators. No confirmation of encryption, system downtime, or negotiation outcomes appears in the supplied record.

Who is dragonforce?

Dragonforce is a ransomware operation that has been publicly documented as using double-extortion tactics: encrypting systems while also stealing data and threatening to publish it on a dedicated leak site if payment is not made. Like many contemporary groups, it typically advertises victims on its site to increase pressure. Public reporting on the group has noted its focus on a range of sectors, including professional services, though specific claims about any single victim must be evaluated carefully.

In this case, the only assertion tied to Miller & Caggiano is the leak-site listing itself. No additional statements attributed to dragonforce about this particular firm—such as sample file dumps, exact data volumes, or timelines—are present in the facts. Readers should therefore regard the listing as the group’s claim rather than established fact.

About Miller & Caggiano

Miller & Caggiano (also referenced in reporting as Miller Caggiano & Kaplan, LLP) is a law firm formed to assist injured and disabled workers navigating disability claims. The partners brought prior experience from organized labor, including work with unions such as the Sheet Metal Workers International Association Local 137 and the Communication Workers of America Local 1104; one partner served as a shop steward for many years. The firm’s practice centers on the legal processes surrounding workplace injury and disability benefits.

Law firms of this type routinely handle confidential client information, medical documentation related to injuries, employment and union records, and correspondence with insurers and government agencies. A breach involving such an organization is consequential because the data often includes personal identifiers and health-related details that can be misused for identity fraud, targeted scams, or further social-engineering attacks against clients and their families.

What was likely exposed

The facts state that internal files were exfiltrated in a ransomware attack. No specific data categories—such as names, Social Security numbers, medical records, or financial details—are itemized beyond that description. The number of people affected is unknown, and the exact contents of the files remain unconfirmed in public reporting.

Organizations in the disability-claims legal sector typically maintain case files containing personal identifiers, medical evaluations, employment histories, union-related documentation, and correspondence with third parties. While those categories are common for the industry, it is not established that any particular type of record was included in the material claimed by dragonforce. Readers should treat the precise exposure as unconfirmed.

The real-world impact

For individuals whose information may have been among the internal files, the primary risks include identity theft, fraudulent disability or insurance claims filed in their names, and phishing or social-engineering attempts that reference real case details. Because disability-related records often contain health and employment information, the potential for targeted misuse exists even if the full contents are not yet public.

For the firm, the incident carries operational, reputational, and regulatory considerations common to professional-services breaches: the need to investigate, notify affected parties where required, and review security controls. No public information confirms the scale of disruption, any financial loss, or the status of client notification. The absence of confirmed victim counts means the concrete human impact cannot yet be quantified from available facts.

What to do if you're exposed

If you have been a client of Miller & Caggiano or believe your information may have been involved, begin by monitoring financial and credit accounts for unexpected activity and consider placing a fraud alert or credit freeze with the major credit bureaus. Review any communications carefully for phishing attempts that reference disability claims or legal matters. Request a free annual credit report and watch for unfamiliar inquiries. Where appropriate, contact the firm through official channels for any guidance they may issue. You can also run a free exposure scan of your email address to check whether it has appeared in known breach data sets, which can help determine whether further monitoring is warranted.

AICompiled with AI assistance from public sources and published under our editorial standards.