Rahnama Law Listed by frag Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People who have worked with Rahnama Law, or whose personal details appear in its case files, face a concrete risk that sensitive records have left the firm’s control. A ransomware group has publicly claimed responsibility for taking internal files, and the listing leaves clients and staff without clear answers about exactly whose information is involved or how widely it may circulate.

The incident was reported on 14 November 2024. The number of people affected remains unknown, and independent confirmation of the full scope has not been published. What is known so far is limited to the group’s own claims and the firm’s public profile as a legal-services practice.

Inside the incident

Rahnama Law was listed by the ransomware group frag on or around 14 November 2024. Public reporting describes the event as a ransomware attack in which internal files were allegedly exfiltrated. No further technical details—such as the initial access method, the duration of unauthorized access, or the precise volume of data taken—have been disclosed by the firm or by independent investigators.

The group’s leak-site entry asserts that it successfully extracted a range of documents. Because the listing itself is an unverified claim, those assertions cannot be treated as confirmed fact. The number of individuals whose records may be among the files is listed as unknown. No ransom demand figure or payment status has been made public.

Who is frag?

frag is a ransomware operation that has appeared on public leak sites in recent years. Like other groups of this type, it typically encrypts systems, exfiltrates data, and then posts victim names and sample files to pressure payment. Its listings often include screenshots or file-tree excerpts intended to demonstrate access. Public reporting has associated frag with attacks on mid-sized professional-services and commercial targets, though the group’s internal structure and full victim list remain incompletely documented.

In this case the only specific claim attributed to frag is the listing of Rahnama Law and the description of documents it says it obtained. No additional statements by the group about this particular victim have been independently verified.

Who is Rahnama Law?

Rahnama Law is a legal-services firm that has operated since 1996. Its public materials state that it focuses on protecting the rights of clients it describes as innocent victims and that it has recovered more than $750 million in damages for those clients. Firms of this kind routinely handle personal-injury, civil-rights, or similar matters that require collection of medical histories, identification documents, financial records, and detailed contact information for both clients and staff.

Because legal practices store precisely the kinds of records that can be used for identity fraud or further social-engineering attacks, any unauthorized removal of internal files carries elevated consequences for the people named in those files.

What data was at risk

The ransomware group claims it extracted internal files. According to the listing, those files include the following categories:

• Corporate non-disclosure agreements
• Contact information of clients and employees
• Employee and customer medical documents
• Employee and client Social Security numbers
• Identification cards

No independent inventory of the taken data has been released, and the exact number of records or individuals involved remains undisclosed. Organisations in the legal sector typically retain precisely these categories of information as part of case work and employment records; whether every claimed category was in fact present and complete cannot be confirmed from public sources alone.

What's at stake

For individuals, the combination of medical documents, Social Security numbers and identification cards creates a durable risk of identity theft, fraudulent account openings, and targeted phishing that references real case details. Contact information can be used to craft convincing messages that appear to come from the firm or from known colleagues. Medical records, once outside controlled systems, cannot be “reset” and may surface years later in secondary markets or social-engineering campaigns.

For the firm, the incident raises questions of client trust, potential regulatory notification duties, and the practical cost of investigating and containing any further misuse of the data. Because the scale remains unknown, both the firm and affected people are operating with incomplete information about the true extent of exposure.

Were you affected?

If you have been a client, employee or vendor of Rahnama Law, treat the possibility of exposure as real until clearer information appears. Monitor financial accounts and credit reports for unexpected activity, place fraud alerts if you have reason for concern, and be cautious of unsolicited messages that reference legal matters or personal details. Change passwords on any accounts that may have shared credentials with firm systems, and enable multi-factor authentication where available.

Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets. Such a scan does not prove or disprove involvement in this specific incident, but it can surface other exposures that warrant attention. Public detail on this event remains limited; any official notifications from the firm itself should be treated as the primary source of further guidance.

AICompiled with AI assistance from public sources and published under our editorial standards.