Moore & Van Allen Listed by SilentRansomGroup Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

When a law firm appears on a ransomware group's listing, the people who matter most are clients, employees, and anyone whose private information may have been held in the firm's systems. Public reporting on 3 September 2025 stated that Moore & Van Allen had been listed by the group known as SilentRansomGroup, which claimed that internal files had been taken in a ransomware attack. The number of people affected remains unknown, and the precise contents of any stolen material have not been confirmed beyond the general description of internal files. For those who have worked with the firm, the practical stakes are straightforward: the possibility that sensitive personal or professional data could be misused if it was among the material the group claims to hold.

What is known so far is limited. The listing itself is a claim by the threat actor, not an independently verified confirmation of every detail. No public figures have been released for the scale of the incident, and no official timeline of intrusion or encryption has been disclosed in the available record. That uncertainty is itself part of the story for anyone trying to decide what steps to take next.

Breaking down the breach

According to the public report dated 3 September 2025, Moore & Van Allen was listed by SilentRansomGroup as a ransomware victim. The report describes the incident as involving the exfiltration of internal files. No further technical detail—such as the initial access method, the duration of any intrusion, whether systems were encrypted, or the volume of data taken—has been made public in the available facts. The number of individuals potentially affected is listed as unknown.

One related public detail notes that Jay Bilas, Of Counsel at the firm, appeared on the podcast “The Dan Patrick Show” on 25 June 2025; the available summary of that appearance is incomplete and does not itself describe the breach. Beyond the listing and the statement that internal files were allegedly exfiltrated, public detail on the incident remains limited. The listing should be treated as the group’s claim rather than as independently confirmed evidence of every asserted fact.

The group behind it: SilentRansomGroup

SilentRansomGroup is a ransomware operation that has appeared in public reporting as a double-extortion actor: it typically claims to steal data before or during encryption and then threatens to publish or sell the material if a ransom is not paid. Like many such groups, it maintains a leak site on which it posts victim names and, in some cases, sample files or larger archives. Public analyses of its activity have described the use of common ransomware tactics—phishing or exploitation of remote-access services for initial access, lateral movement inside networks, data theft, and deployment of encryptors—though the specific tools and techniques can vary by campaign.

The group’s listing of Moore & Van Allen is presented as a claim that the firm was successfully compromised and that internal files were taken. No additional statements by the group about this particular victim—such as ransom demands, deadlines, or sample file releases—are included in the facts provided here. Readers should therefore treat the listing as an unverified assertion pending any confirmation from the organisation or independent investigators.

Moore & Van Allen and its sector

Moore & Van Allen is a law firm. Firms of this type routinely handle confidential client matters, contracts, litigation files, employment records, financial information, and personal data belonging to clients, opposing parties, employees, and third parties. Legal work often involves privileged communications and documents that are sensitive by nature; a breach of such material can affect not only the firm’s operations but also the privacy and legal positions of the people whose information is stored or processed there.

A ransomware incident involving a law firm is consequential because the data at stake is frequently more than routine business records. Even when the exact files taken remain unconfirmed, the sector’s typical holdings mean that clients and staff may face elevated risks of identity misuse, targeted fraud, or exposure of private legal matters if any of that material was among the internal files the group claims to have exfiltrated.

What data was at risk

The available facts state that internal files were exfiltrated in a ransomware attack. No more specific categories—such as client names, Social Security numbers, financial account details, medical information, or privileged correspondence—have been named in the public report. The exact contents therefore remain unconfirmed.

Organisations in the legal sector typically hold a wide range of sensitive material: client intake forms, case files, contracts, billing records, employee personnel files, and communications protected by attorney-client privilege. Because the facts do not enumerate what was actually taken, it is not possible to state that any particular data type was exposed. The only confirmed description is the general claim of internal-file exfiltration.

The real-world impact

For individuals whose data may have been held by the firm, the concrete risks include potential misuse of personal identifiers for fraud or identity theft, targeted phishing that references real legal or employment matters, and the distress of knowing that private information could surface online or be sold. Because the number of people affected is unknown and the precise files are undisclosed, it is not possible to quantify how many people face these risks or how severe any single exposure might be.

For the organisation, a ransomware listing can disrupt operations, require forensic investigation and system restoration, trigger notification obligations under applicable law, and damage client trust. Even when encryption is not confirmed, the claim of data theft alone can create lasting reputational and legal consequences. None of these outcomes has been detailed in the public facts beyond the listing itself; they remain the ordinary, foreseeable effects of such an incident rather than proven events in this case.

Were you affected?

If you are a client, employee, or other individual who has shared personal or confidential information with Moore & Van Allen, treat the listing as a reason to take basic protective steps while recognising that public detail is still limited. Practical first actions include the following:

• Monitor financial accounts and credit reports for unfamiliar activity and consider a fraud alert or credit freeze if you believe high-risk data may have been involved.
• Be alert for phishing or social-engineering attempts that reference legal matters, the firm’s name, or personal details you have shared with lawyers.
• Change passwords on any accounts that reused credentials potentially stored or processed by the firm, and enable multi-factor authentication wherever available.
• Retain any official notices you receive from the firm; they may contain more precise information about what was affected and what support is offered.
• Run a free exposure scan of your email address against known breach data sets to check whether your information has already appeared in public or previously reported leaks.

No public confirmation has established exactly who was affected or which files were taken. Staying informed through official channels from the firm, and taking the ordinary precautions above, remains the most useful response while further facts, if any, become available.

AICompiled with AI assistance from public sources and published under our editorial standards.