Morris-Sockle Listed by qilin Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On October 14, 2025, the ransomware group known as qilin listed Morris-Sockle on its leak site, claiming the firm as a victim of a ransomware attack in which internal files were exfiltrated. Public detail remains limited: the number of people affected is unknown, and no further confirmation of the incident beyond the group's listing has been provided in available records.

Morris-Sockle, PLLC is a law firm focused on family law and divorce matters. A listing of this kind raises immediate questions for clients and others whose information may have been held by the firm, even though the precise scope and contents of any compromise have not been independently verified.

Inside the incident

According to the available record, Morris-Sockle was listed by the qilin ransomware group on October 14, 2025. The group claims that internal files were exfiltrated as part of a ransomware attack. No public information has been released about the method of initial access, the duration of any intrusion, the volume of data involved, or whether systems were encrypted in addition to the claimed exfiltration. The number of individuals potentially affected is listed as unknown. Beyond the leak-site claim itself, independent confirmation of the breach details has not been disclosed in the source material.

Who is qilin?

Qilin is a ransomware operation that has been active in recent years and is known publicly for running a ransomware-as-a-service model. Groups of this type typically recruit affiliates who carry out intrusions, deploy encryption tools, and threaten to publish stolen data unless a ransom is paid—a practice often called double extortion. Public reporting has associated qilin with attacks across multiple sectors, including professional services, and with the use of leak sites to pressure victims by listing them and, in some cases, releasing sample files. These are general characteristics of the actor drawn from established public documentation of its activity; they do not constitute verified statements about the specific claims made against Morris-Sockle. In this instance, the listing of the firm should be treated as an unverified claim by the group unless and until further independent confirmation emerges.

About Morris-Sockle

Morris-Sockle, PLLC is described as a premier law firm specializing in family law and divorce, with more than 40 years of experience assisting clients in protecting their rights during and after divorce proceedings. Firms of this kind routinely handle sensitive personal, financial, and legal information belonging to individuals and families. Because family-law practices deal with matters such as asset division, custody, support, and related court filings, a compromise of their systems can have particular consequences for the privacy and security of those clients. The firm's listing by a ransomware group therefore carries weight beyond a generic corporate incident, given the nature of the data such practices typically maintain.

What was likely exposed

The available facts state only that internal files were exfiltrated in a ransomware attack. No specific categories of documents, client records, or other data types have been named or confirmed. Law firms specializing in family law and divorce commonly hold client contact details, financial disclosures, court documents, correspondence, and other materials related to ongoing or past cases. Whether any of those categories were among the files claimed by qilin remains unconfirmed. Exact contents of the alleged exfiltration are therefore unknown, and no assumption should be made about particular individuals or records until more information is released by the firm or verified through other channels.

What's at stake

For people who have been clients of Morris-Sockle, the primary concern is the possible exposure of personal and legal information that could be used for identity theft, fraud, harassment, or other misuse. Even limited internal files can contain enough detail to create real-world risk if they fall into the wrong hands. For the firm itself, a ransomware listing can disrupt operations, damage client trust, and create legal and regulatory obligations around notification and remediation. Because the scale of any compromise and the precise data involved remain undisclosed, the full extent of impact cannot yet be assessed. The situation underscores the sensitivity of information held by family-law practices and the importance of careful handling of any subsequent notifications or advice the firm may issue.

What to do if you're exposed

If you are a current or former client of Morris-Sockle, or believe your information may have been held by the firm, monitor official communications from the firm for any confirmation or guidance. Watch financial accounts and credit reports for unusual activity, and consider placing fraud alerts or credit freezes if you have reason for concern. Change passwords on accounts that may have been linked to the firm, and enable multi-factor authentication where available. You can also run a free exposure scan of your email address to check whether your information has already appeared in known breach data sets. These steps are practical first measures while further details about the incident remain limited.

AICompiled with AI assistance from public sources and published under our editorial standards.