FBI Warns of Silent Ransom Group's In-Person Law Firm Attacks: Ransomware Claim — What’s Alleged & What To Do

The FBI issued an advisory on May 27, 2026, describing activity by Silent Ransom Group, also referred to as Luna Moth, against U.S. law firms. The warning states that the group has sought client data, legal documents, and sensitive case files through social engineering since 2023, including impersonation of IT staff by telephone or email and, in some instances, physical presence at firm offices. No victim count or list of affected organizations was included in the advisory.

Inside the incident

The advisory provides no specific dates for individual incidents beyond the group's reported activity since 2023. It notes that the group has obtained data for extortion without deploying encryption-based ransomware. The number of people or organizations affected remains undisclosed, and the FBI did not publish details on the volume or contents of any files removed.

How a breach like this happens

Incidents involving social engineering of this type typically begin with reconnaissance of an organization's staff and vendors. Attackers then contact employees by phone or email while posing as internal technical support or trusted third parties, seeking credentials or physical access. When successful, they locate and copy targeted files rather than encrypting systems. The absence of ransomware distinguishes these events from many other extortion operations and can delay detection.

Who is FBI Warns of Silent Ransom Group's In-Person Law Firm Attacks?

Law firms maintain large volumes of client records, contracts, litigation materials, and regulatory filings. These organizations operate under professional confidentiality obligations and often store information that is not publicly available. An advisory directed at this sector highlights the potential reach of the described activity across multiple clients and matters handled by any single firm.

What data was at risk

The advisory names client data, legal documents, and sensitive case files as the categories of information sought. No further inventory of exposed records has been released. Organizations of this kind routinely hold personal identifiers, financial details, medical information, and privileged communications; whether any of those specific elements were accessed in the reported incidents is unconfirmed.

What's at stake

Exposure of client and case materials can affect ongoing legal matters, settlement negotiations, and regulatory compliance for the individuals and entities involved. Law firms may face questions about their handling of confidential information even when the method of access lies outside their direct control. Clients whose records were copied have limited immediate visibility into how the material might be used.

What to do if you're exposed

Individuals who believe their information may have been held by an affected firm should contact that firm directly for any notifications issued. They can also request an explanation of what records were involved and what steps the firm is taking. Running a free exposure scan of their email address against known breach data provides one way to check for prior appearances of their information in public listings.

AICompiled with AI assistance from public sources and published under our editorial standards.