Miller & Zois Listed by qilin Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On June 10, 2026, the ransomware group qilin listed Miller & Zois on its leak site. The listing states that internal files were exfiltrated during a ransomware attack. No figure has been released for the number of individuals whose information may be involved, and no further details about the scope or timing of the incident have been made public. The practical stakes center on the handling of records that law firms routinely maintain for clients. When such files are removed from an organization’s systems, the individuals named in those records face the possibility that their information could later appear in other contexts without their knowledge or consent.

Breaking down the breach

The only confirmed information is the June 10, 2026 listing itself and the statement that internal files were taken. No data volume, file categories, or encryption details have been disclosed by either the organization or the group. The date the files were first accessed, the duration of any unauthorized access, and whether the files were encrypted or only copied remain unknown.

The group behind it: qilin

Qilin is a ransomware operation that has been publicly tracked since 2022. The group typically gains access through compromised remote-access services or stolen credentials, then moves laterally inside networks to locate and copy data before deploying encryption. Its practice of posting victim names on a dedicated site is intended to pressure organizations into negotiations. The listing of Miller & Zois constitutes the group’s claim; no independent confirmation of the data’s authenticity or completeness has been reported.

Who is Miller & Zois?

Miller & Zois operates as a law firm focused on civil litigation, primarily personal-injury matters. Organizations of this type collect and store extensive records that include client identifiers, medical documentation, correspondence with insurers, and case strategy materials. Because these records often contain information that cannot be changed—such as dates of birth, Social Security numbers, or detailed health histories—a compromise carries longer-term implications than the loss of routine business data.

What was likely exposed

The listing refers only to “internal files.” No inventory of specific data fields has been released. Law firms commonly hold client names, contact details, medical records, employment information, and financial documents related to settlements or insurance claims. Whether any of these categories were among the exfiltrated material has not been confirmed.

Why it matters

Files removed from a law firm can contain information that remains sensitive for years. Individuals may later encounter identity misuse, targeted fraud attempts, or unwanted disclosure of private medical or financial circumstances. For the organization, the incident adds the administrative burden of breach notification, regulatory review, and potential litigation from clients whose records were taken.

If your data was in this claimed breach

Begin by monitoring bank, credit, and benefits accounts for unusual activity. Request a copy of any records the firm holds about you and ask what steps it is taking to notify affected clients. Free services that scan known breach repositories for your email address can indicate whether your information has already appeared in public data sets from other incidents; running such a scan provides a baseline for further vigilance.

AICompiled with AI assistance from public sources and published under our editorial standards.