Falk, Waas, Hernandez, Cortina, Solomon & Bonner Overview Metrics Listed by rhysida Ransomware Group

On December 30, 2025, the ransomware group Rhysida listed internal files from the law firm Falk, Waas, Hernandez, Cortina, Solomon & Bonner on its leak site, exposing what public reporting describes as overview metrics and other stolen documents.

Reported Details of the Incident

Available reporting indicates the firm suffered a ransomware attack in which attackers exfiltrated internal files before encrypting systems or demanding payment. The data was later published on the Rhysida leak portal, a common tactic used to pressure victims. No confirmed total of affected individuals has been released, but law firms of this type routinely hold sensitive client records that can include names, addresses, financial details, and case-related personal information.

The breach falls into a pattern of ransomware operators targeting professional services organizations that maintain large volumes of private client data. Public reporting attributes the listing to Rhysida’s standard playbook of stealing data first and then using its public leak site as leverage.

Why This Matters for You and Your Family

When a law firm’s internal files appear on a ransomware leak site, the ripple effects reach far beyond the business itself. If you or any member of your family ever worked with this firm, your personal information may now sit in a publicly accessible repository. Exposed client records can give criminals the raw material they need to open accounts in your name, file fraudulent tax returns, or impersonate you with banks and government agencies.

Even if you were never a direct client, family members sometimes share the same address, phone number, or email domain listed in the stolen files. One leak frequently leads to another as attackers cross-reference the new data against other breaches. For ordinary households this means months or years of unwanted calls, unexpected credit inquiries, and the constant background risk that personal details are being bought and sold on underground forums.

The Doxxing and Identity-Chain Risks

Ransomware groups rarely stop at the first set of stolen documents. Once internal files leave a law firm, attackers can map relationships between employee names, client identities, email addresses, and phone numbers. These connections create what security analysts call an identity chain: a single leaked handle or password can unlock social-media accounts, gaming profiles, and even children’s online identities.

Credential leaks like this one often cascade into account takeovers. A compromised law-firm email might share a password with a parent’s streaming service or a teenager’s Roblox or Fortnite account. From there, attackers can harvest chat logs, payment methods, and additional personal details that make doxxing straightforward. Public reporting indicates that Rhysida and similar groups frequently sell or publish such chained data to amplify pressure on victims and increase resale value on criminal marketplaces.

Rhysida’s Publicly Known Track Record

Public reporting attributes the Rhysida ransomware group’s emergence to mid-2023. Since then the gang has claimed responsibility for attacks on hospitals, schools, financial services firms, and professional organizations across multiple countries. Notable prior victims include healthcare providers and municipal governments whose patient and citizen data appeared on the same leak site now hosting the Falk, Waas, Hernandez, Cortina, Solomon & Bonner files.

The group’s typical playbook begins with initial access through phishing or exploited remote desktop credentials, followed by rapid exfiltration of sensitive folders. After stealing data, Rhysida encrypts victim networks and posts samples on its leak portal with countdown timers. Extortion demands usually combine ransom payments with threats to release or auction the stolen information if deadlines are missed. Industry research from sources such as DoxxScan™ continuous monitoring and ransomware trackers consistently lists Rhysida among active double-extortion operators.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity so you can see exactly what this leak connects to.
• Rotate any password you used at the law firm anywhere else it is reused, then enable two-factor authentication through an authenticator app rather than text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information surfaces you learn within hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often become targets when parent credentials appear in leaks like this one.
• Let DoxxScan remediation specialists handle takedown requests and data-broker removals while you focus on securing accounts and watching for identity-theft warnings.

The incident shows that even professional-service providers you trust can become gateways for identity theft that reaches your family. Taking concrete steps now limits how far attackers can travel down the identity chain created by this claimed breach. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Start your DoxxScan trial today to gain visibility and control before the next wave of misuse begins.