Rella Associates Listed by insomnia Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On December 4, 2025, the ransomware group insomnia listed Rella Associates on its leak site and stated that internal files had been taken during a ransomware attack. The number of people whose information may be involved is not known, and no further details about the volume or contents of the material have been made public. The listing means that any client records, correspondence, or internal documents held by the firm could now circulate outside its control. For individuals who have sought legal representation in workers’ compensation or disability matters, the practical concern is whether personal details connected to their cases have left the firm’s systems.

Inside the incident

The only confirmed information is the date the listing appeared and the group’s assertion that internal files were exfiltrated. No figure has been released for the number of records involved, the date of the intrusion, or the method used to gain access. Rella Associates has not issued a public statement confirming or disputing the claim.

Who is insomnia?

Insomnia is a ransomware group that maintains a public leak site where it lists organizations it claims to have targeted. The group typically encrypts systems and then publishes or threatens to publish material taken from those systems. Its listings are presented by the group itself and are not independently verified at the time they appear. Similar claims by the same actor have involved other professional-service firms in prior incidents.

Rella Associates and its sector

Rella Associates, P.C. is a law firm based in Sleepy Hollow that represents clients in workers’ compensation, Social Security Disability, and NYCERS matters arising from workplace injuries and illnesses. The firm is led by Gerarda Rella and Michael Catallo. Law firms in this practice area routinely receive medical records, employment histories, financial information, and other documentation required to pursue claims on behalf of injured workers.

The information in question

The listing refers only to “internal files.” No inventory of specific data types has been released. Organizations of this kind commonly hold client names, contact details, medical documentation, wage records, and case-related correspondence. Whether any of these categories were among the exfiltrated material remains unconfirmed.

What's at stake

Exposure of internal legal files can result in the circulation of sensitive personal and medical information that clients provided under an expectation of confidentiality. For the firm, the incident may affect ongoing casework and client trust. For individuals, the main risks are identity misuse or unwanted disclosure of health and employment details, though the actual impact depends on what the files contained and whether the material is further distributed.

If your data was in this claimed breach

Monitor accounts for unusual activity and consider placing fraud alerts with credit-reporting agencies. Change passwords for any services linked to the firm and enable multi-factor authentication where available. Readers can run a free exposure scan of their email address against known breach data to check whether their information appears in public listings from this or other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.