MT-LAW [Markman&Tomashin Law Firm] Listed by pay2key Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On September 9, 2021, the ransomware group pay2key listed MT-LAW [Markman&Tomashin Law Firm] on its leak site. The entry states that internal files were taken during a ransomware operation, though the number of individuals whose information may be involved has not been disclosed. The listing means that documents the firm created or received in the course of its work could now circulate outside its control. Law-firm records often contain details that clients expect to remain private, so the incident carries direct implications for those clients even while many basic facts about the event stay unknown.

Breaking down the breach

The only confirmed public information is the September 9, 2021 listing itself. No statement from the firm has described how the intrusion occurred, how long the attackers were present, or whether any data was encrypted in addition to being copied. The number of files taken and the number of people potentially affected are both listed as unknown.

Inside pay2key

Pay2key is a ransomware operator that has used a double-extortion model in multiple incidents. After encrypting systems, the group copies files and posts samples or lists of victims on a public leak site when a ransom demand is not met. The MT-LAW entry follows this pattern: the group claims to have stolen internal data, but no independent confirmation of the claim or of the data’s contents has been published.

MT-LAW [Markman&Tomashin Law Firm] and its sector

MT-LAW [Markman&Tomashin Law Firm] is an Israeli legal practice. Law firms routinely receive, generate, and store contracts, correspondence, financial records, and personal identifiers belonging to clients and opposing parties. Because these materials are protected by professional confidentiality obligations, any unauthorised release can affect both the individuals named in the files and the firm’s own compliance duties.

What data was at risk

The listing refers only to “internal files exfiltrated in ransomware attack.” No inventory of specific document types or data fields has been released. Organisations of this kind commonly hold client names, addresses, identification numbers, case-related financial information, and privileged communications; however, whether any of those categories were among the files taken remains unconfirmed.

The real-world impact

Individuals whose records appear in the exfiltrated material could face risks of identity misuse or unwanted disclosure of sensitive legal matters. The firm itself may incur costs related to investigation, client notification, and regulatory review. At present there is no public evidence that the files have been used for further criminal activity, but the absence of such evidence does not eliminate the possibility.

Were you affected?

Anyone who was a client of MT-LAW [Markman&Tomashin Law Firm] around the time of the incident, or who exchanged documents with the firm, should monitor their accounts and correspondence for unusual activity. Contacting the firm directly can clarify whether individual records were involved. Running a free exposure scan of your email address against known breach data provides one additional way to check whether your information has appeared in public listings from this or other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.