Summa4 Listed by Deadlock Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On June 15, 2026, the Deadlock ransomware group listed Summa4 on its leak site and claimed to have carried out a ransomware attack against the firm. The number of individuals whose information may have been involved remains unknown, and no further details about the scope or confirmation of the incident have been made public. For clients and staff of a Madrid-based legal and tax advisory practice, the listing raises the possibility that internal records containing sensitive personal and financial information could circulate beyond the organization.

Breaking down the breach

The only confirmed public information is the listing itself. Deadlock posted Summa4’s name on its site and stated that internal files had been exfiltrated during a ransomware operation. No figure for the volume of data, the number of records, or the date of the intrusion has been released. It is not known whether Summa4 has acknowledged the incident or whether any data has been published or used in any other way.

The group behind it: Deadlock

Deadlock is a ransomware operation that maintains a public leak site where it lists organizations it claims to have compromised. Like other groups of this type, it typically pairs encryption of systems with the removal of data, then uses the threat of disclosure to pressure victims. The group’s listings are claims made by the actors themselves; independent verification of each incident is not always available at the time of posting.

About Summa4

Summa4, formally SUMMA 4 Asesores Legales y Tributarios, is a Madrid firm established in 2008. It provides legal and tax advisory services to businesses and high-net-worth individuals, with emphasis on tax planning, commercial law, labor matters, and support for family businesses and family offices. Organizations in this sector routinely receive and store detailed financial statements, tax filings, corporate records, and personal identifiers belonging to their clients.

What was likely exposed

The listing refers only to “internal files exfiltrated in ransomware attack.” No inventory of specific data categories has been published. Firms of this kind commonly hold client tax returns, banking details, corporate governance documents, employment records, and communications between advisers and clients. The precise contents of any exfiltrated material remain unconfirmed.

The real-world impact

Exposure of internal files from a legal and tax practice can create prolonged privacy and financial risks for the individuals and companies named in those records. Tax and corporate documents often contain stable personal identifiers and account information that retain value for identity misuse or targeted fraud long after the initial incident. For the firm, the event may affect client trust and trigger regulatory obligations under data-protection rules applicable in Spain and the European Union, though the extent of those obligations depends on facts that have not yet been disclosed.

What to do if you're exposed

Individuals who believe their information may be involved should monitor their tax and financial accounts for unusual activity and consider placing fraud alerts with relevant credit agencies. Changing passwords for any accounts linked to the firm and enabling multi-factor authentication are immediate, low-cost steps. Readers can also run a free exposure scan of their email address against known breach data to check whether their information appears in publicly reported incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.