dsrny.com Listed by ransomhub Ransomware Group

On February 9, 2025, the architecture and design firm Diller Scofidio + Renfro had internal files listed for sale on the RansomHub ransomware leak site after a ransomware attack.

What's Publicly Reported from Reporting

Public reporting indicates that RansomHub posted a data sample from dsrny.com, the firm’s primary domain. The listing appeared on the group’s dark-web leak portal, which is also tracked by ransomware.live. Available reporting describes the exposed material as internal files exfiltrated during the incident. The exact number of people whose personal information appears in the files remains unknown, and the firm has not issued a public statement detailing the volume or specific categories of data involved.

Industry research from sources such as DoxxScan™ continuous monitoring indicates that design, architecture, and cultural organizations frequently store employee names, email addresses, phone numbers, project contracts, and client correspondence in shared drives—the same types of repositories typically targeted in ransomware operations.

Why This Matters for You and Your Family

When a firm like Diller Scofidio + Renfro is breached, the information stolen can include contact details that belong to everyday people: current and former employees, contractors, vendors, and sometimes clients. If your name, email, phone number, or home address was stored in those internal files, it may now be in the hands of criminals who openly auction data. Once sold, that information rarely disappears. It circulates on multiple underground marketplaces and can be combined with other leaks to build a complete profile of you and your household.

Children’s records are not immune. Many families list dependents on employer-provided insurance forms or school-related project documents. A single exposed spreadsheet can link a parent’s work email to a child’s name, date of birth, or even gaming username.

The Doxxing and Identity-Chain Implications

Ransomware groups rarely stop at one leak. They publish or sell data in batches, giving other criminals time to correlate it with older breaches. A work email from the DSRNY files can be matched to personal accounts on social media, shopping sites, or gaming platforms. This creates an identity chain: one exposed credential leads to password reuse on a family streaming account, which leads to a child’s Roblox or Minecraft login. Attackers then pivot to doxxing—publishing addresses, phone numbers, and family relationships to intimidate or extort.

Credential leaks like this one cascade into account takeovers precisely because most people reuse passwords across work and personal services. Gaming accounts are especially vulnerable because they often use the same email address listed in employer directories and frequently lack strong authentication.

RansomHub’s Known Track Record

Public reporting attributes RansomHub’s emergence to mid-2024. The group has since claimed responsibility for attacks on healthcare providers, technology companies, and professional services firms. Its typical playbook begins with initial access gained through phishing, remote desktop protocol brute-force, or stolen credentials. Once inside, operators exfiltrate sensitive files before deploying ransomware. If the victim refuses to pay, RansomHub publishes samples on its leak site and pressures the organization through direct contact and public shaming. The group’s extortion style combines data auctions with threats to notify customers and regulators.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup to remove what you can.
• Rotate the password you used at dsrny.com or any related work account anywhere it is reused, and switch on 2FA through an authenticator app rather than text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information surfaces it is caught in hours, not months.
• Cover the household—DoxxScan family coverage extends to dependents and children’s gaming accounts that often chain back to the same addresses and emails.
• Let remediation specialists handle takedown requests across data brokers and underground forums for you while you focus on securing your own accounts.

The incident is a reminder that any organization storing your information can become the next target, and the fallout can reach every member of your household. Start your DoxxScan trial today. Its continuous monitoring, AI-powered identity-chain mapping, hands-on remediation by specialists, and family coverage—including children’s gaming accounts—give you and your family an active defense against the doxxing chains that follow breaches like this one.