Plan B Die Fachanwaltskanzlei Listed by qilin Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target professional services firms that hold concentrated stores of sensitive client and operational data, using double-extortion tactics that combine encryption with public leak-site threats. In this environment, even smaller specialist practices can appear on criminal listings, creating uncertainty for clients and staff until independent verification occurs.

On 8 September 2025, the German law firm Plan B Die Fachanwaltskanzlei was listed by the ransomware group known as qilin. Public reporting states that internal files were exfiltrated in a ransomware attack; the number of people affected remains unknown, and further technical details have not been disclosed. The listing itself is a claim by the group and has not been independently confirmed in the available record.

What happened

According to the reported summary, Plan B Die Fachanwaltskanzlei was named on a qilin-associated leak site. The group’s own description characterises the firm as a Munich-based practice founded in 2014 that handles criminal defence work, including cases involving theft, robbery, fraud, murder and drug trafficking. The only concrete technical claim provided is that internal files were exfiltrated during a ransomware attack. No public information has been released about the initial access vector, the date of intrusion, the volume of data taken, whether systems were encrypted, or whether any ransom demand was paid or refused. The number of individuals whose information may have been involved is listed as unknown. All specifics beyond the leak-site listing and the statement that internal files were taken remain undisclosed.

The group behind it: qilin

qilin is a ransomware operation that has been active for several years and is widely documented as operating a ransomware-as-a-service model. Affiliates typically gain access to networks, move laterally, exfiltrate data, and then deploy encryption while threatening to publish stolen material on dedicated leak sites if payment is not made. The group has previously claimed responsibility for attacks against organisations in multiple sectors and geographies, often posting samples or file lists to pressure victims. In the present case, the only assertion that can be attributed to qilin is the listing of Plan B Die Fachanwaltskanzlei and the accompanying claim that internal files were taken; no further statements by the group about this specific victim appear in the available facts. As with other such listings, the claim should be treated as unverified until corroborated by the organisation or independent investigators.

Who is Plan B Die Fachanwaltskanzlei?

Plan B Die Fachanwaltskanzlei is a specialised German law firm founded in Munich in 2014. Public descriptions indicate it focuses on criminal defence, representing clients accused of serious offences. Law firms of this type routinely hold highly sensitive material: client identity documents, case files, correspondence with courts and prosecutors, financial records related to fees and legal aid, and internal administrative data. Because the firm’s work involves individuals facing criminal proceedings, any unauthorised access to its systems carries particular weight. A breach at such an organisation can affect not only the firm’s operations and reputation but also the privacy and legal position of clients who may already be in vulnerable circumstances. The available record does not indicate the firm’s size, number of lawyers, or precise practice volume, so those details remain outside the What's Publicly Reported.

What was likely exposed

The only data category named in the public record is “internal files” said to have been exfiltrated. No inventory of file types, no sample documents, and no confirmation of specific personal data categories have been released. Organisations of this kind typically maintain client personal data, case notes, court filings, billing information, employee records and internal communications. Whether any of those categories were among the files taken is unconfirmed. Readers should therefore treat any assertion about particular documents or data fields as speculative until the firm or competent authorities provide a verified disclosure. The absence of a published data inventory means the precise scope of exposure cannot be stated as fact.

What's at stake

For individuals whose information may have been held by the firm, the principal risks include identity misuse, targeted social engineering, and the potential exposure of sensitive legal matters that could affect personal safety, employment or ongoing proceedings. Even partial internal files can contain enough context for criminals to craft convincing phishing messages or to attempt account takeovers. For the firm itself, the consequences may include regulatory notification duties under European data-protection rules, possible civil claims, operational disruption, and reputational harm that could deter future clients. Because the number of affected people is unknown and the exact contents of the exfiltrated material remain undisclosed, the full scale of these risks cannot yet be quantified. The situation underscores the broader reality that professional-service providers holding privileged or confidential material remain attractive targets for ransomware operators seeking leverage.

Were you affected?

If you have been a client, employee or business contact of Plan B Die Fachanwaltskanzlei, monitor official communications from the firm for any confirmation or guidance. Consider placing fraud alerts with credit-reference agencies, reviewing financial and email accounts for unusual activity, and changing passwords on any services that may have shared credentials with the firm. Because the volume and nature of the data remain unconfirmed, these steps are precautionary rather than evidence of confirmed compromise. Readers can also run a free exposure scan of their email address against known breach datasets to determine whether their information has already appeared in other publicly documented incidents; such a check provides an additional, independent data point while waiting for further official details.

AICompiled with AI assistance from public sources and published under our editorial standards.