true.co.uk Listed by blackbasta Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People who have dealt with TRUE Solicitors LLP may now face uncertainty about whether their personal or case-related information has been exposed. The firm, which handles sensitive legal matters for individuals across personal injury, clinical negligence and related claims, was listed by the BlackBasta ransomware group in early 2024. Public detail remains limited, yet the listing itself raises practical questions for clients, staff and anyone whose records may sit among the internal files the group claims to have taken.

What is known so far is that BlackBasta publicly claimed responsibility for a ransomware attack involving true.co.uk, stating that roughly 312 GB of data had been exfiltrated. The number of people affected is unknown, and independent confirmation of the full scope has not been released. For ordinary people whose details may be involved, the immediate concern is the potential for identity misuse, targeted fraud or unwanted contact arising from any leaked material.

What happened

On 9 February 2024 it was reported that true.co.uk had been listed by the BlackBasta ransomware group. According to the group’s claim, internal files were exfiltrated during a ransomware attack. The listing described the data volume as approximately 312 GB and referred to categories that included group data, financial material, legal material and a further incomplete label beginning “Pe”. No further technical details about the intrusion method, the precise date of the attack, or any ransom demand have been made public in the available record. The number of individuals whose information may be contained in the material is unknown. The listing itself constitutes an unverified claim by the group; independent verification of the full contents or of successful decryption of systems has not been disclosed.

The group behind it: blackbasta

BlackBasta is a ransomware operation that became publicly active in 2022. Like many contemporary groups, it typically employs a double-extortion model: encrypting systems while also copying data and threatening to publish it if a ransom is not paid. The group has previously targeted organisations across multiple sectors, often gaining initial access through compromised credentials, phishing or exploitation of known vulnerabilities, then moving laterally to identify and extract valuable files before deploying encryption. Its leak site is used to name victims and, in some cases, to release samples of stolen data as pressure. In this instance the group claims to have listed true.co.uk and to have obtained roughly 312 GB of internal material; no additional statements by BlackBasta specifically about this victim beyond the listing details have been provided in the available facts. Attribution rests on the group’s own claim rather than on independent forensic confirmation released publicly.

true.co.uk and its sector

TRUE Solicitors LLP is a UK law firm operating under the true.co.uk domain. Public information describes it as specialising in personal injury claims, clinical negligence cases, financial mis-selling, residential conveyancing and housing disrepair claims. It maintains offices in Newcastle upon Tyne and Birmingham. As a solicitors’ practice, it routinely holds client files that contain medical histories, financial records, correspondence with insurers and courts, identity documents and other confidential material generated during the course of legal representation. Law firms of this type sit at the intersection of personal data and high-value commercial information; a breach therefore carries consequences both for the individuals whose cases are handled and for the firm’s ability to maintain client confidentiality and regulatory compliance. The firm’s own public materials emphasise the experience of its solicitors and legal executives, underscoring the volume of sensitive casework that typically flows through such an organisation.

What data was at risk

The available facts state that internal files were exfiltrated in a ransomware attack. BlackBasta’s listing refers to a data volume of approximately 312 GB and lists categories described as group data, financial, legal and a truncated fourth category. Exact file names, the precise nature of the “group data” or the full meaning of the incomplete label have not been disclosed. Organisations of this kind typically hold client personal data, medical and injury records, financial statements, conveyancing documents, correspondence and internal administrative files. Because the facts do not confirm the specific contents beyond the broad categories claimed by the group, it is not possible to state with certainty which individual records were included. The exact data types remain unconfirmed outside the group’s own description.

The real-world impact

For people whose information may have been among the exfiltrated files, the practical risks include identity theft, phishing attempts that reference genuine case details, and the possibility that medical or financial information could be misused. Even partial records can enable more convincing social-engineering attacks. For the firm itself, the incident raises questions of operational disruption, potential regulatory scrutiny under data-protection rules, and the need to notify affected parties if personal data is confirmed to have been compromised. Because the number of people affected is unknown and the precise contents remain unconfirmed, the scale of individual harm cannot yet be quantified. Clients and staff may experience heightened anxiety while waiting for clearer information, and the firm may face reputational and financial costs associated with investigation, remediation and any subsequent claims.

What to do if you're exposed

If you have been a client or employee of TRUE Solicitors LLP, monitor bank and credit accounts for unexpected activity and treat unsolicited communications that reference your case with caution. Consider placing fraud alerts with credit-reference agencies and changing passwords on any accounts that may have shared credentials with the firm. Keep records of any suspicious contact. Readers can also run a free exposure scan of their email address to check whether their information has already appeared in known breach data sets. If you receive formal notification from the firm, follow the guidance it provides and retain copies for your own records. Public detail on this incident remains limited; further confirmed information, if released, will help clarify the next practical steps.

AICompiled with AI assistance from public sources and published under our editorial standards.