Navigating Ransomware Data Dumps

By Spencer McLennan · Published July 22, 2025 · Updated July 2026

Modern ransomware isn't just about encrypting and holding your data hostage anymore. The newer and more dangerous model is simpler: the attackers quietly copy your data, and then threaten to publish it unless you pay. Some groups skip the encryption entirely — no locked files, no dramatic ransom screen — just a quiet exfiltration followed by a demand.

For most businesses, good backups defeat encryption. They do nothing against the threat to publish. And a law firm is exactly the kind of victim these groups target.

Double extortion and the leak site

The mechanism has a name: double extortion. Steal the data, encrypt (or don't), and pressure the victim with a public "leak site" where the stolen files get posted if the demand isn't met. The FBI issued a specific warning in 2025 about a group running this playbook against law firms — pure data-extortion, driven by social engineering rather than malware, with victim firms named on a public leak site when they don't pay.¹ Security researchers tracking the space counted well over a hundred ransomware incidents against the legal sector across 2025 and into 2026, and noted clusters of firms appearing together — a signature of the vendor-supply-chain problem from Chapter 9.²

Why law firms draw this fire is not mysterious: they hold highly sensitive material — litigation strategy, transactions, client data — and they operate under intense pressure to keep it confidential, which is precisely what makes the threat to publish effective.³

What actually reduces this risk

Prevention here is mostly the rest of this guide, aimed at the left side of that flow diagram:

1. Close the initial-access routes. Most ransomware starts with a stolen credential (Ch. 2, Ch. 5), a phished staff member (Ch. 7), an exposed service (Ch. 6, Ch. 11), or a compromised vendor (Ch. 9). The prevention was in those chapters.

2. Backups still matter — for the encryption half. Offline, immutable, tested backups defeat the file-locking side and are non-negotiable. Just don't mistake them for protection against publication.

3. Minimize and segment data. The less sensitive data you hold, and the more it's segmented, the less an intruder can exfiltrate in one reach. Data you deleted under a retention policy can't be dumped.

4. Detect the exfiltration, not just the encryption. Because the damage is at exfiltration, monitoring that can flag unusual outbound data movement is what gives you a chance to act before the fork.

5. Have an incident response plan — before. Formal Opinion 483's clearest practical instruction is that the decision to have a plan, and its content, must be made before a breach.⁴ Who leads, who calls counsel, who contacts the regulator, who notifies clients, how you communicate if email is down. A plan written during an incident is not a plan.

6. Know your notification obligations in advance. Given how much the statutory duties vary, the time to determine what you'd owe, to whom, and how fast is now — with counsel — not while the clock is running.

Your firm's ransomware-readiness checklist

• Initial-access routes closed (credentials, phishing, exposed services, vendors — Ch. 2, 5, 6, 7, 9, 11)
• Offline, immutable, tested backups
• Data minimized under a retention policy and segmented
• Monitoring capable of flagging unusual outbound data movement
• Written incident response plan, created before an incident and tested
• Notification obligations (ethical and statutory) determined in advance with counsel

Spencer McLennan is the founder and lead webmaster of LegalWebmasters, and has handled websites, hosting, and security for law firms and professional practices across the United States and Canada since 2007. He holds an MBA, a PCM from the American Marketing Association, and is a graduate student in intelligence studies. He writes the Law Firm Cybersecurity and Law Firm SEO & Design guides. Connect on LinkedIn.