milbermakris.com Listed by lockbit3 Ransomware Group

On September 08, 2023, the law firm Milber Makris Plousadis & Seiden, LLP appeared on the LockBit 3.0 ransomware leak site. The listing states that internal files were exfiltrated during a ransomware attack against the civil litigation defense practice, which works closely with insurance companies. The number of people whose information is contained in those files remains unknown, and the precise data types have not been detailed by the threat actors.

Primary Disclosure Details

The LockBit 3.0 leak page, still accessible via its onion address as of the initial publication, claims the firm suffered a successful ransomware intrusion and that exfiltrated internal files would be published if a ransom is not paid. The disclosure does not quantify affected records, list specific data fields, or provide a ransom amount. It simply labels the victim as a “full-service civil litigation defense firm and business partner to the insurance industry.” No formal regulatory filing or customer notification from the firm has surfaced publicly at the time of this writing, so the exact scope rests entirely on what the LockBit operators chose to publish.

Why This Matters for You and Your Family

When a law firm that handles civil litigation and insurance matters is breached, the files taken often contain personal information submitted by claimants, policyholders, witnesses, or opposing parties. Even though the disclosure does not specify what was taken, internal files exfiltrated in a ransomware attack frequently include names, addresses, dates of birth, Social Security numbers, medical records, financial details, and correspondence that can be used for identity theft or fraud. If your insurance claim, lawsuit defense, or deposition records passed through this firm, your information may now sit in an attacker-controlled archive. The risk extends beyond the firm’s direct clients; family members, dependents, and anyone whose records were referenced in case files can also be exposed.

Doxxing and Identity-Chain Risks

Ransomware groups rarely stop at posting a single zip file. Once internal documents are leaked, opportunistic actors scrape them for email addresses, usernames, phone numbers, and client identifiers. These fragments are then correlated with other breaches to build detailed identity chains. A single leaked insurance claim form can link your home address to a username used on social media, a child’s school records, or an old gaming account. That chain becomes the foundation for spear-phishing, SIM-swapping, or full doxxing campaigns. Because law firms routinely store information on minors involved in family or injury cases, children’s identities are often swept up as well.

LockBit 3.0 Track Record

Public reporting attributes the LockBit 3.0 variant to a ransomware-as-a-service operation that first appeared in early 2020 under the original LockBit name. The group rebranded to LockBit 2.0 in 2021 and then to LockBit 3.0 in 2022 after releasing new encryptors and a bug-bounty program for vulnerabilities in their own code. Notable prior victims include numerous law firms, healthcare providers, and insurance-related entities. Their standard playbook involves initial access through phishing, remote desktop protocol brute-force, or exploited vulnerabilities, followed by claimed exfiltration of sensitive files before encryption. They then pressure victims with dual extortion: threats to publish data on their leak site and, in some cases, direct contact with the victim’s customers or partners. The group’s leak site has remained one of the most active ransomware boards, regularly listing new victims every week.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity so you can see exactly what chains back to this claimed breach.
• Rotate any password you used at milbermakris.com or with the firm anywhere else it is reused, and switch to 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information surfaces you learn within hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often become the weakest link in doxxing chains after credential leaks like this one.
• Let remediation specialists handle takedown requests across data brokers and leak repositories on your behalf while you focus on securing your own accounts.

The incident underscores how even a single successful ransomware deployment against a professional services firm can ripple outward for years. Staying ahead requires more than changing a password; it demands ongoing visibility into how your information travels across the internet. DoxxScan by GalaxyWarden delivers that visibility through continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with household coverage that includes children’s gaming accounts vulnerable to credential-based takeovers. Start your DoxxScan trial today and close the gaps before the next wave of abuse begins.