💼 Professional & Business Services

Legal, accounting, consulting, staffing, marketing, real estate services · a shareable slice of the daily brief for stakeholders who only care about this industry · RSS feed

Victims L30D3▼ −17

Prior 30D20

Active actor L90DQilin · 4

Active actor L90DSilentRansomGroup · 4

Active actor L90DN0n · 3

Today — 03 Nov 2026

A coordinated voice-phishing campaign flagged by Canada's national cyber agency has now compromised employee accounts at two of the country's largest law firms.CriticalProfessional & Business ServicesThe Canadian Centre for Cyber Security's Alert AL26-028 (Oct 28) warns of an ongoing help-desk-impersonation vishing campaign targeting Canadian legal- and financial-sector organizations, with infrastructure traced back to January and October activity concentrated on the legal sector. McCarthy Tétrault says it detected the campaign late Oct 22 and notified clients Oct 29; Bennett Jones says two business-services employee accounts were compromised Oct 19, contained, and reported to law enforcement — both firms say their document-management/client-file systems were not reached. No threat actor has been named by either firm or by the CCCS; the tradecraft (IT-helpdesk impersonation, fraudulent sign-in pages) matches a known playbook but should not be attributed without a sourced claim. CCCS AL26-028 · McCarthy Tétrault · Bennett Jones

Last 14 days

PwC (UK) — claimed by Everest, partially company-confirmed, now an open ongoing-attack case.HighProfessional & Business ServicesEverest's leak-site listing (Oct 22) claims ~590GB from a third-party vendor platform holding PwC training/learning records; PwC confirms a cyber incident at that vendor but says its own network and operations are unaffected, and has not confirmed the 590GB figure. Sources disagree on the exact negotiation clock (4-day, 5-day, or an Oct 28 publication deadline cited by different outlets) — all expired or expiring as of this run with no sample data published. Opened in `data/cases.jsonl`; will be followed to outcome. Cybernews · IDN Financials

Recent victim claims

Newest first, mapped to this industry from the victim database. Most are leak-site claims — verify before acting.

October 2026

Oct 22 PwC (UK) Everest Ransomware · professional services · UK Everest listed PwC on its leak site claiming ~590GB exfiltrated from a third-party vendor platform that stored PwC training/learning records; PwC confirms a cyber incident at the third-party vendor but says it did not affect PwC's own network or operations, and has not confirmed the 590GB figure or client/sensitive-data exposure. · Sources: Cybernews · IDN Financials

Oct 14 Interior Technologies N0n Ransomware · physical security services · USA N0n ransomware group claimed Interior Technologies, a US smart-building and surveillance-systems integrator, alleging gateway configuration data and surveillance feeds taken. No company statement or independent corroboration beyond the aggregator listing; treat as an unverified claim. · Sources: DeXpose

Oct 12 Poole Group LockBit Ransomware · accounting and consulting · Australia LockBit listed Poole Group, an Australian accounting and consulting firm, on its leak site with a roughly two-week publication deadline. A secondary aggregator claim that the firm confirmed a breach and notified Australian regulators could not be independently corroborated against primary reporting; treat the entire listing as unverified pending confirmation. · Sources: Breachsense

Oct 03 Center State Engineering The Gentlemen Ransomware · Professional Services · US Small US (NJ) civil-engineering firm (~15 staff); The Gentlemen claim ~340GB. Unverified claim, no company confirmation. · Sources: Ransomware.live

Oct 01 Consilio LockBit Ransomware · legal services · USA Global legal-services/eDiscovery technology company; claim listed, no scope disclosed, no company confirmation. · Sources: GalaxyWarden

Oct 01 Krycler, Ervin, Taubman & Kaminsky Akira Ransomware · Professional Services · US Sherman Oaks, California accounting/consulting firm; Akira claims ~88GB of employee and client documentation. Catch-up record, missed by the Oct1-3 sweeps. Unverified claim, no company confirmation. · Sources: DeXpose

September 2026

Sep 30 Law Offices of R. David Williams, P.A. Rhysida Ransomware · Professional & Business Services · USA Fort Lauderdale, Florida criminal-defense law firm listed on Rhysida's leak site Sep 30; no company confirmation. · Sources: Ransomware.live

Sep 27 Revenga Smart Solutions Qilin Ransomware · Business Services · Spain Business-services company listed on Qilin's leak site. Unverified claim, no company confirmation. · Sources: Ransomware.live · GalaxyWarden

Sep 26 Magna Legal Services Storm Ransomware · Professional & Business Services · USA Nationwide litigation-support/legal-services provider (Philadelphia, PA); listed on Storm's leak site, no company confirmation. · Sources: Board Cybersecurity

Sep 24 efada.sa Krybit Ransomware · professional services · Saudi Arabia Saudi consulting/professional-services firm listed on Krybit's leak site; no data volume or company confirmation. · Sources: Ransomware.live

Sep 24 NEAD Pro Rhysida Ransomware · professional services · Italy Italian multidisciplinary services firm (Gorizia/Udine) listed on Rhysida's leak site; no company confirmation. · Sources: Ransomware.live

Sep 24 bnlawmacau.com / bn-ip.com Incransom Ransomware · legal services · Macau, China Macau law/IP practice listed on Incransom's leak site; no company confirmation. · Sources: Ransomware.live

Sep 23 Legis Rhysida Ransomware · professional / legal publishing · Colombia Rhysida listed Legis, a 60-year-old Latin American legal and business information publisher operating across Colombia, Venezuela, Argentina, Mexico, Peru and Chile, on its leak site Sep 23, claiming SQL databases, legal documents, shareholder/ID copies, customer contracts and litigation/finance logs; no company confirmation, and the listing describes a data-theft claim rather than confirmed encryption. · Sources: RedPacket Security · Hendry Adrian

Sep 22 NAI Earle Furman secp0 Ransomware · real estate · US secp0 listed NAI Earle Furman, a southeastern-US commercial real-estate brokerage/property-management firm, on its leak site, claiming a 1.36M-path file-server snapshot covering deal records, property-management records, broker commissions, employee home directories, plus data from the absorbed Croxton Gray firm. No company confirmation. DLS claim only. · Sources: DeXpose

Sep 22 AFRICA-TECH N0n Ransomware · professional services · Mali N0n listed AFRICA-TECH, a Malian IT-services/document-processing firm, on its leak site, claiming client documents (scans, attestations, insurance/embassy files) and shared business folders, and claiming backups/shadow copies were destroyed. No company confirmation. DLS claim only. · Sources: RedPacket Security

Sep 22 Clark Hill SilentRansomGroup Ransomware · professional services · US SilentRansomGroup listed Clark Hill, a Detroit-headquartered full-service law firm (corporate, litigation, IP, healthcare, cybersecurity practices), on its leak site. SRG's model relies on social engineering and legitimate admin tools rather than encryption, so this is a data-exposure/extortion claim. No company confirmation. DLS claim only. · Sources: GalaxyWarden

Sep 21 SECOND HOUSE INCRANSOM Ransomware · real estate · Spain INC Ransom listed SECOND HOUSE, a Spanish real estate/hospitality firm, on its leak site Sep 21. No data scope or company confirmation disclosed. DLS claim only. · Sources: RedPacket Security

Sep 20 Studio Notarile Associato Salvatore Costantino E Anna Favarato Emperador Ransomware · professional services · Italy Emperador listed this Italian notarial/legal-services firm on its leak site Sep 20. No data scope or company confirmation disclosed. DLS claim only. · Sources: RedPacket Security

Sep 18 Transcom WorldWide (PayPal support operations) N0n Ransomware · Business Process Outsourcing · Sweden N0n claims 86.7 million connection records showing PayPal support-agent Citrix/AAA sessions and internal AD/PKI/Netskope/Zscaler maps across eight sites; unverified, no company confirmation · Sources: https://www.redpacketsecurity.com/n0n-ransomware-victim-paypal-support-operations-transcom-worldwide/

Sep 15 HandyTrac (Greystar – Litchfield Park, AZ) Shadowbyt3$ Ransomware · Property management · USA Shadowbyt3$ listed a Greystar-managed property's HandyTrac key-control portal on its leak site Sep 15, claiming physical-to-digital key maps, property intelligence/vulnerability logs, employee identity and credential data, financial and vendor records, and administrative portal control. No company confirmation. DLS claim only. · Sources: https://www.ransomware.live/id/SGFuZHlUcmFjIChHcmV5c3RhciBMaXRjaGZpZWxkIFBhcmssIEFaKUBTaGFkb3dCeXQzJA==

Sep 14 Better Accounting Solutions Anubis Ransomware · Accounting · USA Anubis listed Better Accounting Solutions, a Wall Street-area accounting firm, on its leak site Sep 14, describing an accountants' data breach. No data volume disclosed and no company confirmation. DLS claim only. · Sources: https://www.dexpose.io/intel-feeds/

Sep 14 Bernath & Rosenberg Genesis Ransomware · Accounting · USA Genesis claimed responsibility Sep 14 for a cyberattack on Bernath & Rosenberg, a US full-service CPA firm, with an estimated attack date of Sep 13. No data volume disclosed, no company confirmation. DLS claim only. · Sources: https://www.dexpose.io/genesis-ransomware-strikes-bernath-rosenberg/

Sep 07 Lightcast Direwolf Ransomware · hr software · US US-based provider of human resources / labor-market analytics software; Direwolf DLS claim Sep 7, 2026; data scope and impact unconfirmed. 🟥 Unverified DLS claim; verify before treating as a breach. · Sources: https://www.redpacketsecurity.com/direwolf-ransomware-victim-lightcast/

Sep 04 Blanco & Etcheverry Gunra Ransomware · law/professional services · Uruguay Uruguayan law firm (~$5M revenue); Gunra DLS claim Sep 4; no data scope or operational impact disclosed; 🟥 DLS claim only; verify before treating as a breach · Sources: https://ransomware.live/id/QmxhbmNvICYgRXRjaGV2ZXJyeUBndW5yYQ== · https://www.redpacketsecurity.com/gunra-ransomware-victim-blanco-etcheverry/

Sep 03 Complete Packaging Solutions Qilin Ransomware · Professional Services · UK Qilin DLS claim Sep 3 2026; UK business services and packaging solutions provider. 🟥 Unverified DLS claim. · Sources: https://www.dexpose.io/qilin-ransomware-targets-complete-packaging-solutions/

Sep 03 Katten Muchin Rosenman SilentRansomGroup Ransomware · law firm · US Am Law firm claimed by SilentRansomGroup; DLS Sep 3; full-service US law firm; data scope and authenticity unverified. · Sources: https://www.redpacketsecurity.com/silentransomgroup-ransomware-victim-katten-muchin-rosenman/

Sep 02 Greenberg Traurig SilentRansomGroup Ransomware · law firm · US Am Law firm claimed by SilentRansomGroup; DLS Sep 2; data scope and authenticity unverified; threat to publish if no contact made. · Sources: https://www.dexpose.io/silentransomgroup-compromises-greenberg-traurig/

Sep 01 Holland & Knight SilentRansomGroup Ransomware · law firm · US Am Law firm claimed by SilentRansomGroup; DLS Sep 1; data scope and authenticity unverified; threat to publish if no contact. · Sources: https://www.hookphish.com/blog/ransomware-group-silentransomgroup-hits-holland-and-knight/

August 2026

Aug 29 LAPoco Architects Qilin Ransomware · Professional Services · USA Qilin DLS claim Aug 29, 2026; architecture firm; scope and data volume unconfirmed · Sources: https://www.ransomware.live/summary/

Aug 23 Aurore Development S.p.A. Qilin Ransomware · Professional Services · Italy Italian business services company; Qilin DLS claim Aug 23 threatening data exposure · Sources: https://www.dexpose.io/qilin-targets-aurore-development-s-p-a-in-ransomware-attack/

Aug 10 ATMS & Co. LLP INC Ransom Ransomware · Professional Services · IN Chartered accountant firm; INC_RANSOM DLS posting August 10, 2026; part of INC's SonicWall SMA 1000 exploitation campaign (CVE-2026-15409/CVE-2026-15410 CVSS 10.0); data scope unconfirmed · Sources: https://thehackernews.com/2026/08/inc-ransomware-emerges-as-dominant.html

Aug 09 Studio Associato Tibaldi Unknown Ransomware · Professional Services · ITA DLS claim posted August 9 on ransomware.live; Italian professional firm based in Rome; group attribution not confirmed in available sources · Sources: https://www.ransomware.live/

Aug 08 Louisville Bar Association INC Ransom Ransomware · Legal / Professional Association · US INC Ransom DLS claim August 8 2026; Kentucky-based legal professional association; consistent with INC Ransom sustained 2026 legal-sector campaign; no victim statement; data scope unconfirmed · Sources: https://www.ransomware.live/group/incransom

Aug 07 Morguard Corporation Helix Ransomware · Real Estate · CA Helix ransomware group (emerged July 2026; Microsoft OAuth/SharePoint data exfiltration, no custom malware) posted DLS claim Aug 7; 160GB claimed exfiltrated; negotiations broke down. Helix uses voice phishing and OAuth abuse targeting SharePoint. · Sources: https://ransomware.live/id/TW9yZ3VhcmRASGVsaXg=

Aug 06 Signature Services Play Ransomware · Business Services · US Play ransomware DLS listing, Aug 6 2026; files encrypted, data exfiltrated · Sources: https://ransomware.live/id/U2lnbmF0dXJlIFNlcnZpY2VzQHBsYXk=

Aug 02 Encore Enterprises CRPxO Ransomware · Real Estate · US CRPxO DLS claim August 2 2026; US commercial real estate firm; attacker claims 700 GB exfiltrated. No victim statement; data not yet published. · Sources: https://www.ransomware.live/id/RW5jb3JlIEVudGVycHJpc2VzLCBJbmMuQENSUHhP

Aug 01 Questel SAS ShinyHunters Extortion · Intellectual Property Management · France ShinyHunters DLS posting August 1 2026 with August 4 contact deadline; claims 21M+ Salesforce records plus 147 GB internal corporate data; Questel is a major IP and patent management firm serving global enterprise clients; no statement from Questel; data not yet published · Sources: https://breachnews.com/breaches/shinyhunters-lists-questel-alcon-and-lumenis-on-leak-site-with-new-extortion-claims/ https://www.dexpose.io/shinyhunters-breach-questel-sas-french-ip-giant-under-siege/

July 2026

Jul 29 Accenture 888 Ransomware · Professional Services / Consulting · US Threat actor 888 (PwnForums) claimed theft of 35 GB including Azure DevOps source code, Azure access keys, tokens, RSA/SSH keys, and config files; Accenture confirmed incident was contained with no operational impact; disclosed approximately July 29 2026 · Sources: https://www.securityweek.com/accenture-confirms-data-breach-after-hacker-claims-source-code-theft/ https://www.bleepingcomputer.com/news/security/accenture-confirms-breach-after-hacker-offers-stolen-data-for-sale/

Jul 27 Ernst and Young ShinyHunters Extortion · Professional Services · US Supply-chain compromise of third-party IT service management platform Mar 28-Apr 12 2026; yielded credentials to EY Jira, GitHub, Azure; client tax documents with SSNs and financial data; July 31 2026 deadline issued · Sources: https://www.bleepingcomputer.com/news/security/ernst-and-young-data-breach-claimed-by-shinyhunters-extortion-gang/

Jul 25 Jubilee Jobs Qilin Ransomware · Business Services/Staffing · Unknown DLS posting July 25 2026 by Qilin. Employment/staffing services firm. Country and data scope unconfirmed. · Sources: https://www.ransomware.live/

Jul 25 The Myers Y Cooper Qilin Ransomware · Professional Services · Unknown DLS posting July 25 2026 by Qilin. Professional services firm; sector and country unconfirmed from snippets. · Sources: https://www.ransomware.live/

Jul 25 Health Law Advocates INC Ransom Ransomware · legal-nonprofit · US Boston non-profit legal organization; INC Ransom DLS posting July 26 2026, estimated attack date July 25; data scope unconfirmed; 🟥 unverified DLS claim · Sources: https://www.ransomware.live/

Jul 15 Ernst & Young (EY) Unattributed Breach · professional services (accounting/consulting) · United Kingdom EY disclosed on July 15 that client data was accessed via a compromised third-party IT support platform used for UK client engagements; breach window estimated March-April 2026; exposed data includes client tax records, investment data, and Social Security Numbers for affected individuals; EY notified affected clients directly; investigation ongoing with external forensics; no ransomware group has claimed the breach; attack vector believed to be credential theft at the third-party vendor · Sources: https://www.bleepingcomputer.com/news/security/ey-discloses-data-breach-exposing-client-tax-and-financial-records/

Jul 13 Allied Plumbing Heating & Cooling Qilin Ransomware · services · US HVAC/plumbing services company claimed on Qilin DLS; data type and volume unconfirmed · Sources: ransomware.live · breachsense.com

Jul 13 Access Group International DragonForce Ransomware · business services · US Business services company claimed on DragonForce DLS July 13; data type and volume unconfirmed · Sources: ransomware.live · purpleops.io

Jul 12 Century Equities Qilin Ransomware · real estate · US Real estate company claimed on Qilin DLS; data type and volume unconfirmed · Sources: ransomware.live · breachsense.com

Jul 11 Alan F. Burke CPA Qilin Ransomware · accounting · US Qilin DLS claim July 11, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.ransomware.live/group/qilin · Sources: [ransomware.live]

Jul 10 The Schuett Companies Qilin Ransomware · real estate · construction/US Qilin DLS claim July 10, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.ransomware.live/group/qilin · Sources: [ransomware.live]

Jul 10 Sintax Qilin Ransomware · legal services · Belgium Qilin DLS claim July 10, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.ransomware.live/group/qilin · Sources: [ransomware.live]

Jul 08 HIVE360 DragonForce Ransomware · HR · payroll services/UK DragonForce DLS claim July 8, 2026; data scope and impact unconfirmed; 🟥 unverified · https://sharkstriker.com/blog/ransomware-roundup/ · https://www.ransomware.live/group/dragonforce · Sources: [SharkStriker] · [ransomware.live]

Jul 08 PCCC Realty LLC NightSpire Ransomware · real estate · US NightSpire DLS claim July 8, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.ransomware.live/group/nightspire · Sources: [ransomware.live]

Jul 08 Greenbotz Everest Ransomware · services · unknown region Everest DLS claim July 8, 2026; data scope and impact unconfirmed; 🟥 unverified · https://sharkstriker.com/blog/ransomware-roundup/ · https://www.ransomware.live/group/everest · Sources: [SharkStriker] · [ransomware.live]

Jul 07 Chisholm, Persson & Ball, PC Akira Ransomware · legal · law firm/US Akira DLS claim July 7, 2026; 45 GB claimed including client passports, visas, SSNs, court files, and police reports; data scope unconfirmed; 🟥 unverified · https://www.hookphish.com/blog/ransomware-group-akira-hits-chisholm-persson-and-ball/ · https://www.ransomware.live/group/akira · Sources: [HookPhish] · [ransomware.live]

Jul 06 Wood Ellis & Wood CPA Qilin Ransomware · professional services · accounting/US Qilin DLS claim July 6, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.dexpose.io/qilin-ransomware-attack-on-wood-ellis-wood-cpa/ · https://www.ransomware.live/group/qilin · Sources: [DeXpose] · [ransomware.live]

Jul 06 Max Fordham Qilin Ransomware · professional services · building engineering/UK independent building engineering consultancy (MEP/sustainability; clients include museums, schools, housing); Qilin DLS claim July 6, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.dexpose.io/qilin-ransomware-targets-max-fordham-in-uk-cyberattack/ · https://www.ransomware.live/group/qilin · Sources: [DeXpose] · [ransomware.live]

Jul 06 CSEC RATP The Gentlemen Ransomware · services · France The Gentlemen DLS claim July 6, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.ransomware.live/group/thegentlemen · Sources: [ransomware.live]

Jul 02 Amtivo SETTRA Ransomware · ISO certification · professional services/US ANAB-accredited ISO and management system certification body (formerly Orion, ASR, CMA, Audit3, QSR, ISA in North America); offers ISO 9001, 14001, 27001, 45001 certification and training; SETTRA DLS claim July 1–2, 2026; data scope and impact unconfirmed; 🟥 unverified · https://x.com/FalconFeedsio/status/2071991911431426416 · https://www.ransomware.live/group/settra · Sources: [FalconFeeds] · [ransomware.live]

Jul 02 X-Copper Professional Corporation MoneyMessage Ransomware · legal services · Canada Canadian law firm specialising in traffic ticket defence, minor criminal charges, and licence-related legal matters; MoneyMessage DLS claim July 2, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.hendryadrian.com/ · Sources: [hendryadrian.com]

Jul 01 Dennis Waters Rental Properties Qilin Ransomware · real estate · US residential rental property company; Qilin DLS claim July 1, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.dexpose.io/ · Sources: [DeXpose]

Jul 01 Laughlin Nunnally Hood & Crum Qilin Ransomware · legal services · US US law firm; Qilin DLS claim July 1, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.dexpose.io/ · Sources: [DeXpose]

---

← All industries · Victim database →