Wright Constable & Skeen Listed by qilin Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On June 10, 2026, the ransomware group qilin listed Wright Constable & Skeen on its leak site and claimed to have exfiltrated internal files from the organization. The number of people affected has not been disclosed, and no additional details about the timing, method, or scale of the incident have been made public. This listing adds to the pattern of ransomware operators publicly naming professional services firms as part of their operations.

Inside the incident

Public information about the event is limited to the group’s listing of the organization. The report states that internal files were exfiltrated during a ransomware attack, but provides no further description of how access was obtained or what volume of data may have been involved. No confirmation from Wright Constable & Skeen has been noted in available records, and the number of individuals whose information may be affected remains unknown.

The group behind it: qilin

Qilin is a ransomware operation that has appeared in public reporting since at least 2022. Like several other groups active in the same period, it follows a double-extortion model in which data is first copied and later threatened with public release if a ransom demand is not met. The group maintains a leak site where it lists organizations it claims to have targeted. Its listings constitute claims by the operator rather than independently verified incidents.

About Wright Constable & Skeen

Wright Constable & Skeen operates as a law firm. Organizations of this type routinely maintain records that include client communications, case files, financial details, and identifying information about individuals involved in legal matters. A breach affecting such an entity is consequential because the material held by law firms is often subject to legal privilege and confidentiality obligations that extend beyond the firm itself.

What data was at risk

The only data category named in connection with the listing is internal files exfiltrated during the ransomware attack. No inventory of specific document types, client names, or record categories has been released. While law firms commonly store client identifiers, correspondence, and matter-related documents, the precise contents of the exfiltrated material have not been confirmed.

Why it matters

Exposure of internal files from a law firm can create downstream risks for clients whose matters were documented in those files. Such risks include potential misuse of personal or financial information and complications arising from the disclosure of privileged communications. For the organization, the incident adds operational and reputational considerations typical of ransomware events, regardless of whether any demanded payment was made.

If your data was in this claimed breach

Individuals who believe their information may have been held by Wright Constable & Skeen should monitor accounts for unusual activity and consider placing fraud alerts with credit reporting agencies. Changing passwords for any associated online services and enabling multi-factor authentication are standard first steps. Readers can also run a free exposure scan of their email address against known breach data sets to check for prior appearances of their information.

AICompiled with AI assistance from public sources and published under our editorial standards.