Ransomware group Silentransomgroup claims attack on law firm Lowenstein Sandler

Key points

• Silentransomgroup, a ransomware gang, listed Lowenstein Sandler LLP on its dark-web leak site on 2026-10-28, claiming to have attacked the firm.
• Threat Vectr has tracked 3 Silentransomgroup claims in the last 90 days, starting with Baker McKenzie on 9 October 2026.
• Professional Services is the sector that appears most frequently in the group's claimed attacks.
• Lowenstein Sandler has not publicly confirmed any incident, and the claim could not be independently verified at publication time.
• Leak-site listings are written by criminals to pressure victims into paying; they are sometimes exaggerated and occasionally false.

A ransomware group called Silentransomgroup has claimed to have attacked Lowenstein Sandler LLP, a national law firm founded in 1961 and headquartered in New York City. The listing appeared on the group's dark-web leak site on 2026-10-28, according to monitoring service Ransomware.live, which tracks these postings.

Ransomware is malicious software that criminals use to lock a company's files and then demand payment to restore access. Leak sites are dark-web pages, meaning websites that ordinary browsers cannot reach, where ransomware gangs publicly name their alleged victims to increase pressure to pay. Listings sometimes appear days or weeks before any public statement from the targeted organisation, and their contents are written by the attackers themselves, never by any independent party.

Lowenstein Sandler has not issued any public statement about the claimed incident.

How active is this group?

Very active, at least by their own account. This is the third Silentransomgroup claim we've reported in 90 days: the group previously listed Kirkland & Ellis on 23 October and Morrison Cohen just yesterday. That pattern suggests deliberate focus on the legal sector, not opportunistic scanning.

Those figures are counts of unverified criminal claims, not confirmed breaches. Still, the pace signals a group operating at volume.

Law firms are a logical target for data-theft extortion. They hold confidential client files, financial records, and litigation strategy: exactly the kind of material a client would pay to keep private. That calculus applies across the sector, not only to Lowenstein Sandler.

What should clients and staff do right now?

Because the claim is unconfirmed, there's no proven breach to respond to yet. A few sensible precautions cost nothing.

Watch for phishing emails, meaning messages crafted to look legitimate that try to trick you into clicking a link or handing over a password. Criminals sometimes use news like this as bait, sending fake emails that appear to come from the firm or from a breach-notification service. If you receive an unexpected email referencing this story and asking you to click anything or enter credentials, treat it as suspicious.

Don't reuse the same password across multiple accounts. If a breach does turn out to be real, any password shared with another service becomes a weak point elsewhere.

Be wary of unsolicited calls offering "breach compensation" or asking you to confirm personal details. No legitimate law firm or security service reaches out cold requesting that information.

If you're a client of the firm and have specific concerns, check the firm's official website directly for any formal statement rather than relying on third-party reports.

Common questions

Does a leak-site listing mean the breach definitely happened?

No. Ransomware groups post these listings to pressure companies into paying, and the claims are sometimes exaggerated or entirely false. Nothing is confirmed until the targeted organisation says so publicly.

Why would criminals target a law firm specifically?

Law firms hold some of the most sensitive documents in existence, including client secrets and deal terms. That makes the threat of public exposure a powerful lever, which is exactly why these groups find them attractive targets.