pmsp.at Listed by incransom Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On November 06, 2025, the Austrian law firm operating as pmsp.at was listed by the ransomware group known as incransom. Public details remain limited: the group claims to have exfiltrated internal files in a ransomware attack, specifically company data, payment and tax documentation, employee and client documents, as well as projects and developments belonging to Piaty Müller-Mezin Schoeller Rechtsanwälte GmbH. The number of people affected is unknown, and no independent confirmation of the breach's full scope has been made public.

This listing matters because law firms routinely handle highly sensitive personal, financial and legal information. Even an unverified claim of data theft raises concrete risks of identity misuse, financial fraud and professional confidentiality breaches for clients, employees and the firm itself.

Inside the incident

What is known so far comes almost entirely from the incransom leak-site listing dated November 06, 2025. The group asserts that it conducted a ransomware attack against pmsp.at and successfully exfiltrated internal files. The claimed contents include company data, payment and tax documentation, employee and client documents, and materials related to projects and developments. No further technical details—such as the initial access method, the exact date of intrusion, the volume of data taken, or whether systems were encrypted—have been disclosed in public reporting. The number of individuals whose information may be involved remains unknown. At present the listing stands as an unverified claim by the threat actor; no official statement from the firm confirming or denying the incident has been incorporated into the available facts.

Inside incransom

Incransom is a ransomware operation that follows the now-common double-extortion model. After gaining access to a network, the group typically steals data before deploying encryption, then threatens to publish the stolen material on a dedicated leak site if a ransom is not paid. Public tracking of the group shows it has previously listed victims across multiple sectors, using the same pattern of posting sample files or descriptions of stolen data to pressure organisations. Like many such actors, incransom operates as a closed affiliate-style crew rather than a single individual, and its leak-site posts are promotional claims rather than independently verified inventories. Nothing in the public record beyond the listing itself confirms that the specific files described for pmsp.at have been released or sold.

Who is pmsp.at?

pmsp.at is the online presence of Piaty Müller-Mezin Schoeller Rechtsanwälte GmbH, an Austrian law firm. Firms of this type provide legal advice and representation in commercial, corporate and private-client matters. They necessarily hold confidential client files, contracts, correspondence, financial records and personal identification documents. Because legal professional privilege and data-protection rules place a high duty of care on such organisations, any unauthorised access to their systems is consequential: it can expose not only the firm’s own operational data but also the private affairs of clients who entrusted the firm with sensitive information. A breach claim therefore carries implications for professional reputation, regulatory scrutiny and the privacy of everyone whose records the firm maintains.

What data was at risk

According to the incransom listing, the group claims to possess company data, payment and tax documentation, employee and client documents, and materials concerning projects and developments. These categories are consistent with the kinds of records a law firm would normally store: client identity papers, case files, invoices, payroll information and internal project notes. However, the exact contents, volume and sensitivity of any files actually taken remain unconfirmed. Public detail does not specify whether the data include full personal identifiers, bank details, medical or family information, or merely administrative summaries. Until independent verification occurs, the precise nature of the exposed material must be treated as an unverified claim rather than established fact.

The real-world impact

For individuals whose data may be among the claimed files, the practical risks include identity theft, targeted phishing, financial fraud and unsolicited contact that leverages knowledge of legal matters. Employees could face exposure of payroll or tax records; clients could see confidential legal strategies or personal circumstances become public or sold. For the firm itself, the consequences may include regulatory inquiries under European data-protection rules, potential civil claims from affected parties, and lasting damage to client trust. Because the number of people affected is unknown and no confirmation of data publication has been reported, the scale of these risks cannot yet be quantified, but the categories of data claimed are inherently high-value to criminals.

What to do if you're exposed

If you have been a client or employee of Piaty Müller-Mezin Schoeller Rechtsanwälte GmbH, treat the listing as a prompt for caution rather than confirmed compromise. Monitor bank and credit accounts for unusual activity, enable multi-factor authentication on email and financial services, and be alert to phishing messages that reference legal or tax matters. Consider placing a fraud alert with credit bureaus if you reside in a jurisdiction that offers that service. Readers can also run a free exposure scan of their email address to check whether their information has already appeared in known breach data sets. If you receive formal notification from the firm, follow the specific guidance it provides and retain copies of any correspondence for your records.

AICompiled with AI assistance from public sources and published under our editorial standards.