Moses & Singer Listed by Leakeddata Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On August 08, 2026, the ransomware group known as Leakeddata listed Moses & Singer on its leak site, asserting that it held data belonging to the firm and that an offer of $250,000 had been made to prevent publication. Public detail remains limited: the number of people affected is unknown, and the specific types of data involved have not been disclosed. The listing itself constitutes a claim by the group rather than independently verified confirmation of a breach.

For clients, employees, and counterparties of a full-service law firm, any credible assertion that internal material may have been taken raises practical concerns about confidentiality and downstream misuse. What is known so far is confined to the group’s public posting and the reported ransom figure; everything else is unconfirmed.

Inside the incident

According to the available record, Leakeddata added Moses & Singer to its leak site on or around the reported date of August 08, 2026. The group’s accompanying statement claimed that the firm had offered $250,000 to keep the data from being published. No further technical particulars—such as the initial access vector, the duration of any intrusion, the volume of data allegedly taken, or forensic confirmation by the firm—have been made public in the source material.

The number of individuals potentially affected is listed as unknown. Data types named as exposed are recorded simply as “not disclosed.” In the absence of additional statements from Moses & Singer or independent investigators, the incident rests on the threat actor’s unverified listing and the single reported financial figure tied to non-publication.

Who is Leakeddata?

Leakeddata is a ransomware operation that follows the now-familiar double-extortion model: encrypting systems where possible and simultaneously exfiltrating data so that the threat of public release can be used as leverage. Groups of this type typically maintain a dark-web leak site on which they name victims, post samples or full archives if payment is not received, and sometimes publish purported negotiation details. Their activity is well-documented across multiple sectors; they have previously listed professional-services firms, manufacturers, and other organizations whose data carries both operational and reputational value.

As with other actors in this category, a listing on the Leakeddata site is a claim advanced by the group itself. It does not automatically establish that the named organization suffered a confirmed breach, nor does it prove the accuracy of any ransom or negotiation figures the group chooses to display. Independent verification, victim acknowledgment, or regulatory filings are required before such claims can be treated as established fact. In this case, the record contains only the group’s assertion regarding Moses & Singer and the stated $250,000 offer.

About Moses & Singer

Moses & Singer LLP is a full-service law firm. Firms of this kind routinely handle client matters spanning corporate transactions, litigation, intellectual property, employment, real estate, and private-client work. In the ordinary course of practice they hold correspondence, contracts, financial records, personal identifying information of clients and employees, privileged legal advice, and other confidential material.

A breach affecting a law firm is consequential precisely because of that concentration of sensitive information. Privilege, professional secrecy obligations, and the trust placed in counsel mean that unauthorized access or exfiltration can expose not only the firm but also the individuals and businesses it represents. Even when the precise scope of an incident remains unconfirmed, the mere possibility that such material has left the firm’s control creates lasting practical and reputational considerations.

The information in question

The source record states that the data types exposed are “not disclosed.” No inventory of files, databases, or record categories has been published in the available facts. Consequently it is not possible to state as fact what, if anything, was taken.

Organizations of this type typically maintain client files, billing and trust-account records, employee personnel data, internal emails, draft pleadings and agreements, and identity documents supplied during engagement. Any or none of these categories may be implicated; the exact contents remain unconfirmed. Readers should treat speculative lists of compromised data as unverified until Moses & Singer or competent authorities provide clarity.

The real-world impact

For individuals whose information may have been involved, the concrete risks include targeted phishing that references genuine legal matters, identity theft if personal identifiers were present, and the possible exposure of private financial or family details. Because law-firm files often contain material about third parties—opposing counsel, witnesses, business partners—the circle of potentially affected people can extend beyond the firm’s own clients and staff.

For the organization itself, the consequences center on regulatory notification duties, possible professional-liability exposure, the cost of investigation and remediation, and the erosion of client confidence. Even when a ransom payment is alleged or discussed, payment does not guarantee deletion of copies held by the attackers, nor does it eliminate the risk of later recirculation. Until the firm issues a detailed accounting, the scale of these impacts cannot be quantified.

Were you affected?

If you are a current or former client, employee, or counterparty of Moses & Singer, monitor account statements and credit reports for unfamiliar activity, and treat unsolicited communications that reference legal matters with heightened caution. Enable multi-factor authentication on email and financial accounts where available, and consider placing a fraud alert with the major credit bureaus if you believe personal identifiers may have been exposed. Because the number of people affected and the precise data types remain unknown, these steps are prudent rather than proof of compromise.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach datasets. That check will not confirm or rule out involvement in this specific incident, but it can surface credentials or personal data that have circulated from other events and that deserve immediate attention.

AICompiled with AI assistance from public sources and published under our editorial standards.