Tarolli, Sundheim, Covell & Tummino LLP Listed by lorenz Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On or around April 5, 2023, the law firm Tarolli, Sundheim, Covell & Tummino LLP appeared on a leak site operated by the lorenz ransomware group. The group claims to have stolen internal files from the firm in a ransomware attack. How many people may be affected remains unknown, and public detail about the precise contents of those files is limited. For clients, employees, and others whose information may sit inside a law firm’s systems, the practical stakes are straightforward: legal matters often involve sensitive personal, financial, and proprietary details that can be misused if they leave the firm’s control.

This article sets out only what has been reported, places the claim in the context of how lorenz typically operates, and outlines what people can usefully do while the full scope stays unconfirmed.

Breaking down the breach

According to the available record, Tarolli, Sundheim, Covell & Tummino LLP was listed on the lorenz ransomware leak site, with the listing reported on April 5, 2023. The group claims to have exfiltrated internal files in a ransomware attack. No confirmed figure for the number of people affected has been published. The method of initial access, the duration of any intrusion, whether systems were encrypted, and whether any ransom demand was paid or refused are all undisclosed in the public summary. What is stated is limited to the leak-site listing itself and the group’s assertion that internal data was taken. Until the firm or independent investigators release further verified detail, the scale and exact timeline remain unconfirmed.

Inside lorenz

Lorenz is a ransomware operation that has been active for several years and is known for double-extortion tactics. In this model, operators typically encrypt a victim’s systems and also copy data beforehand, then threaten to publish or sell the stolen material if payment is not made. The group has historically maintained a public leak site where it names organisations it claims to have breached and, in some cases, posts samples or larger archives of files. Like other ransomware crews, lorenz has targeted organisations across multiple sectors rather than a single industry. Listings on such sites are claims by the attackers; they are not independent confirmation that every asserted file was in fact taken or that every named organisation suffered the full impact described. In this incident, the public record reflects only that Tarolli, Sundheim, Covell & Tummino LLP was named and that lorenz claims internal data was stolen. No further statements attributed to the group about this specific victim appear in the provided facts.

Tarolli, Sundheim, Covell & Tummino LLP and its sector

Tarolli, Sundheim, Covell & Tummino LLP is a law firm organised as a limited liability partnership. Firms of this type routinely handle client matters that generate correspondence, contracts, filings, discovery materials, and internal work product. Depending on the practice areas involved, those materials can include personal identifiers, financial records, intellectual-property details, employment information, and confidential business strategies. Law firms are attractive targets for ransomware groups precisely because the data they hold is often both sensitive and time-critical to the people and companies it concerns. A breach claim against such an organisation therefore raises immediate questions about client confidentiality, regulatory notification duties, and the integrity of ongoing legal work, even when the precise inventory of taken files has not been made public.

The information in question

The facts state that internal files were exfiltrated in a ransomware attack. No more granular inventory—such as specific categories of personal data, client names, or file volumes—has been disclosed in the available record. Organisations of this kind typically maintain client contact details, matter files, billing and payment records, employee information, and internal administrative documents. It is not confirmed which, if any, of those categories were among the files lorenz claims to have taken. Readers should treat any assertion about exact data types beyond “internal files” as unconfirmed until corroborated by the firm or by regulators.

Why it matters

For individuals whose information may have been held by the firm, the concrete risks include potential misuse of personal or financial details for fraud, targeted phishing that references real legal matters, or exposure of private disputes and business arrangements. Even when attackers do not immediately publish everything they claim to hold, the existence of a copy outside the firm’s control creates lasting uncertainty. For the organisation itself, a ransomware listing can trigger notification obligations, client inquiries, possible regulatory scrutiny, and the operational cost of investigating and containing the incident. Because the number of people affected is unknown and the exact file set is undisclosed, both the human and institutional impact remain difficult to quantify from public sources alone. The absence of confirmed numbers does not reduce the need for caution; it simply means responses must be based on prudent assumptions rather than a finished forensic picture.

If your data was in this claimed breach

If you are a client, former client, employee, or other party who has dealt with Tarolli, Sundheim, Covell & Tummino LLP, treat the claim seriously while recognising that details are still limited. Monitor account statements and credit reports for unfamiliar activity, and be alert to emails or calls that appear to reference your legal matters or personal details in an effort to obtain further information or payments. Consider placing fraud alerts with major credit bureaus if you believe sensitive identifiers may have been involved. Preserve any notice you receive directly from the firm, and follow its instructions for credit monitoring or identity-protection services if they are offered. You can also run a free exposure scan of your email address to check whether your information has already surfaced in known breach data sets. That step does not confirm or rule out involvement in this specific incident, but it can help you see whether your credentials or personal details are circulating more widely and decide what additional protections to put in place.

AICompiled with AI assistance from public sources and published under our editorial standards.