Fox Rothschild and Weil Gotshal See Data Breaches Amid Ransomware Attacks Against Law Firms

Law Firm Ransomware Breaches Show the Weak Point Is the Firm's Front Door, Not the Evidence Platform

Fox Rothschild and Weil Gotshal have both confirmed data breaches from May 2026, part of a wave of social-engineering-based ransomware attacks against large law firms that the FBI has attributed to a hacker group known as Silent Ransom Group, or Luna Moth. Fox Rothschild is reviewing the incident after a class action lawsuit filed Tuesday, June 9, alleged the firm mishandled it; Weil confirmed a comparable breach the same month. Cybersecurity attorneys quoted by Law.com say some large firms hit in this campaign have already paid ransoms, while others have had sensitive material posted to the dark web.

What actually happened at these two firms?

Both firms confirmed May breaches linked to a coordinated social-engineering ransomware campaign the FBI attributes to Silent Ransom Group, also called Luna Moth.

The detail that matters for e-discovery buyers isn't the attribution — it's the entry method. Silent Ransom Group's attacks reportedly rely on social engineering, meaning the initial compromise runs through people (help desks, employees, credential resets), not a firewall flaw. That's a different threat model than the one most litigation-tech security reviews are built around, and it's spreading across Am Law-sized firms rather than one outlier.

Why should an e-discovery buyer care about a law firm's IT breach?

Because litigation collections increasingly sit outside the firm's own servers, in a vendor's cloud — which is exactly the concentrated, sensitive dataset a ransomware crew wants.

An e-discovery platform holds the most privileged material a firm has by design: emails, chats, scanned documents, recordings, all coded and cross-referenced. If the attack surface is a social-engineered credential rather than a technical exploit, the question isn't just "is the vendor's infrastructure hardened" — it's who can be tricked into granting access, and what blast radius that grant has once it's inside.

What should buyers be asking their own vendors right now?

Ask where processed evidence physically sits, who controls the encryption keys, and whether any of it trains a shared model.

Single-tenant deployment, or hosting inside the firm's own AWS account under its own keys, changes the answer to "what did the attacker actually get" if a vendor employee's credentials are compromised — the data never leaves the client's boundary in the first place. Firms reviewing this incident should also ask vendors directly about chain-of-custody logging and whether access defaults fail closed when authentication looks unusual, not just whether data is encrypted at rest.

Does paying the ransom actually solve the problem?

Not according to cybersecurity attorneys tracking this campaign — payment doesn't undo exposure of whatever was already copied out.

The reporting notes some large firms have paid, and others have seen material published anyway. That sequencing — exfiltration before any ransom demand — is the operational lesson: prevention and access control matter more than negotiation strategy once a social-engineering attack succeeds.

Frequently asked questions

Who is Silent Ransom Group?

It's the hacker group, also known as Luna Moth, that the FBI has tied to a string of social-engineering ransomware attacks against law firms that emerged in late May 2026, per Law.com.

Has either firm disclosed how many clients or records were affected?

That detail isn't in the public reporting reviewed here. Fox Rothschild said it is reviewing the incident, and a class action filed June 9, 2026 alleges the firm mishandled the breach.

Is this the first law firm ransomware campaign tied to this group?

Law.com describes it as part of a string of attacks against a group of law firms in late May 2026, not an isolated incident at either firm.

Source: Fox Rothschild and Weil Gotshal See Data Breaches Amid Ransomware Attacks Against Law Firms, Law.com, June 9, 2026.