Brown and Streza Listed by losttrust Ransomware Group

On September 26, 2023, the law firm Brown and Streza appeared on the leak site of the losttrust ransomware group. The listing states that internal files were exfiltrated during a ransomware attack. The firm, which provides integrated legal services in tax planning, trusts and estates, ultra-high-net-worth planning, charitable sector work, business succession, and real estate, has not publicly quantified how many client records may be affected.

Details from the Leak-Site Listing

The primary disclosure on the losttrust leak site, archived via ransomware.live, states that Brown and Streza data was obtained through a ransomware incident. It does not specify the exact volume of records, the precise file types beyond “internal files,” or any ransom demand amount. The listing simply presents the firm’s name alongside samples of allegedly stolen material and a deadline for payment. Public reporting on losttrust indicates the group follows a double-extortion model: encrypt systems where possible, exfiltrate documents, then threaten both decryption refusal and public release of sensitive information.

Why This Matters for You and Your Family

If you or your family have ever worked with Brown and Streza, your personal, financial, or estate-planning documents may now sit in an attacker’s archive. Trust documents, tax records, real-estate deeds, and succession plans often contain Social Security numbers, bank details, family member names, addresses, and dates of birth. Exposure of this information raises the risk of identity theft, fraudulent loan applications, and targeted phishing campaigns that reference your specific legal or financial arrangements. Even if you are not a direct client, professionals and advisors linked to the firm could have had their contact lists or correspondence included, indirectly exposing your information.

Doxxing and Identity-Chain Risks

Ransomware listings like this one frequently lead to doxxing chains. Attackers or opportunistic criminals scrape leaked emails, phone numbers, and names, then cross-reference them across social media, gaming platforms, and data-broker sites. A single exposed email can link your professional identity to personal accounts, including children’s gaming handles that reuse the same password or security questions. Once those connections surface, harassers can publish home addresses, family photos, or financial summaries. The identity-chain implications extend far beyond the original breach; one leak can cascade into account takeovers months later.

Losttrust Group Track Record

Public reporting attributes the first known activity of losttrust to mid-2023. The group has targeted professional-services firms, manufacturers, and healthcare providers. Its typical playbook begins with initial access gained through phishing or exploited remote-desktop services, followed by lateral movement, data exfiltration, and deployment of ransomware. After encryption, operators wait a short period before publishing victim names on their leak site and offering proof files. They usually set payment deadlines measured in days or weeks and increase pressure by releasing additional data samples if the victim does not pay. The group’s exact size and location remain unclear, but its tactics align with other mid-tier ransomware operations that prioritize speed over long-term stealth.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup to remove what you can.
• Rotate any password you ever used at Brown and Streza anywhere it has been reused, and switch to 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your data is caught in hours, not months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same address or credentials.
• Let remediation specialists handle takedown requests across data brokers and extortion sites on your behalf.

The exposure of Brown and Streza’s internal files underscores how quickly professional-services data can reach criminal marketplaces. Staying ahead requires more than reactive checks; it demands ongoing visibility and expert help. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts vulnerable to credential-based takeovers. One short forward-looking step today can sharply reduce the months-long risk that follows any new leak.