Semple & Cooper Listed by interlock Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 7 May 2025, the accounting firm Semple & Cooper appeared on a listing associated with the interlock ransomware group. Public detail remains limited: the number of people affected is unknown, and the only description of the material involved is that internal files were allegedly exfiltrated during a ransomware attack. For clients, employees and partners of a regional certified public accounting practice, the practical stakes are immediate. Firms of this kind routinely handle tax returns, financial statements, payroll records and confidential business information; any unauthorised access to those materials can create lasting exposure to fraud, identity misuse or regulatory complications.

Because the listing itself is a claim by the group rather than an independently confirmed disclosure by the firm, the full scope of what occurred has not been verified in public sources. Still, the mere assertion that internal files left the organisation is enough to warrant careful attention from anyone who has entrusted Semple & Cooper with personal or corporate data.

Inside the incident

According to the available record, Semple & Cooper was listed by the interlock ransomware group on 7 May 2025. The report states that internal files were exfiltrated in a ransomware attack. No further technical detail has been released: the precise date the intrusion began, the method of initial access, the volume of data taken, or the number of individuals whose information may be involved all remain undisclosed. The firm has not publicly confirmed or denied the listing in the materials provided for this account. In short, the incident is known only through the group’s claim that a ransomware operation resulted in the removal of internal files.

Who is interlock?

Interlock is a ransomware operation that has appeared in public reporting as a group that combines encryption of victim systems with the threat of data publication—commonly called double extortion. Like other actors in this category, it maintains a leak site on which it posts the names of organisations it claims to have compromised, often accompanied by samples or full archives of stolen material if a ransom is not paid. Public analyses of prior interlock activity describe the use of standard ransomware tooling, data-exfiltration stages, and pressure tactics aimed at both the victim organisation and, at times, its clients or partners. No specific statements by interlock about Semple & Cooper beyond the listing itself are recorded in the facts at hand; the group’s claim is therefore treated as an unverified assertion rather than established fact.

Semple & Cooper and its sector

Semple, Marchal & Cooper, LLP is described as a leading regional certified public accounting firm based in the Southwest. It provides accounting, auditing, tax planning, compliance and management-consulting services to clients across technology, healthcare, retail and non-profit sectors. Professional services firms of this type sit at the centre of their clients’ financial lives: they prepare tax filings, review financial statements, advise on regulatory compliance and often store multi-year archives of sensitive records. A breach at such a firm is consequential precisely because the data it holds is rarely limited to a single transaction; it can span years of personal and corporate financial history, making the potential for secondary misuse correspondingly broad.

The information in question

The only data type named in the public record is “internal files exfiltrated in a ransomware attack.” Exact contents have not been disclosed. Organisations of this kind typically retain client tax returns, financial statements, payroll data, audit work papers, correspondence containing personal identifiers, and internal operational documents. Whether any of those categories were among the files taken remains unconfirmed. Until the firm or independent investigators provide a verified inventory, the precise nature of the exposure cannot be stated as fact.

The real-world impact

For individuals and businesses whose information may have been among the internal files, the concrete risks include identity theft, fraudulent tax filings, targeted phishing that leverages accurate financial details, and potential regulatory or contractual fallout if client data is later published. For the firm itself, the consequences can include operational disruption, legal notification obligations, reputational damage and the cost of forensic investigation and remediation. Because the scale of the exfiltration is unknown, the number of people who may need to take protective steps is also unknown; caution is therefore warranted for anyone who has been a client or employee in recent years.

Were you affected?

If you have done business with Semple & Cooper or its predecessor entities, treat the listing as a signal to review your own exposure rather than as proof that your specific records were taken. Practical first steps include:

• Monitor bank, credit-card and tax accounts for unexpected activity and consider placing a fraud alert or credit freeze with the major credit bureaus.
• Change passwords on any accounts that may have shared credentials or recovery information with the firm, and enable multi-factor authentication wherever available.
• Watch for phishing messages that reference tax filings, audits or invoices and that appear to come from the firm or from tax authorities.
• Retain copies of any correspondence you have received from Semple & Cooper so you can compare it against future communications.

Readers can also run a free exposure scan of their email address to check whether their information has already surfaced in known breach data sets. Public detail on this incident remains limited; any official notification from the firm itself should be treated as the authoritative source of further guidance.

AICompiled with AI assistance from public sources and published under our editorial standards.