Moses & Singer Listed by Leakeddata Ransomware Group

On August 08, 2026, the ransomware/extortion group Leakeddata added Moses & Singer LLP to its public leak site, claiming the New York-based law firm had refused a $250,000 payment to prevent publication of allegedly stolen data. The firm has not, as of this writing, issued any public confirmation or regulatory filing about the incident.

Leak-Site Claim Details

The listing on the Leakeddata leak site, tracked via RansomLook, states that the group obtained files from Moses & Singer and is offering them for download unless the firm pays the demanded sum. The disclosure does not specify the volume of records involved, the exact data types allegedly taken, or which internal systems were accessed. According to the leak-site entry, the group first approached the firm with an extortion demand of $250,000 and, after non-payment, listed the organization publicly. Because the sole primary source is the threat actor’s own leak site rather than a company notification or regulator filing, this remains an unconfirmed claim.

Why This Matters for You and Your Family

When a law firm’s data appears on a ransomware leak site, anyone whose records were held by that firm faces heightened risk. Moses & Singer provides full-service legal representation; its clients routinely entrust the firm with sensitive personal, financial, medical, and business documents. If the group’s claims are accurate, your names, addresses, Social Security numbers, financial details, or case files could be circulating among criminals. Even without official confirmation, the public listing itself can trigger secondary criminals to target anyone connected to the firm.

Doxxing and Identity-Chain Risks

A single leaked record rarely stays isolated. An email or phone number taken from a law firm can be cross-referenced with credential-stuffing databases, public records, and social-media handles to build a complete identity chain. Home addresses exposed in such incidents place every person living at that location at risk. Children’s gaming accounts, often secured with the same email or a reused password as a parent’s professional correspondence, become easy entry points for account takeover that can lead to further doxxing. These chains grow faster than most people realize and can result in identity theft, targeted phishing, or physical threats.

Leakeddata Group’s Known Activity

Public reporting attributes Leakeddata with operating a double-extortion model: exfiltrating data before encrypting systems, then threatening both data publication and ransom demands. The group emerged in late 2024 and has listed dozens of organizations, primarily targeting mid-sized professional services firms, manufacturers, and healthcare providers. Their typical playbook involves initial access through compromised credentials or vulnerable remote desktop services, followed by quiet exfiltration over weeks or months before launching the extortion phase. They maintain an active leak site and frequently increase pressure by releasing small sample files as proof of compromise.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity, then use the no-subscription cleanup to begin removing your data from exposed sources.
• Enable continuous DoxxScan monitoring across 13.1 billion breach records and more than 100 platforms so the next time your information surfaces you are alerted within hours rather than months.
• Immediately rotate any password you have reused at Moses & Singer or any other legal, financial, or professional service, and secure every account with a hardware-backed or authenticator-based 2FA method.
• Let remediation specialists handle takedown requests across data brokers and people-search sites on your behalf, as manual removal is rarely complete or timely.
• Treat any unexpected communication claiming to be from Moses & Singer with extreme caution and verify directly through official published contact channels before responding.

The appearance of a respected law firm on a ransomware leak site is a reminder that professional-service providers remain high-value targets. Protecting yourself requires more than hoping the claim is false; it demands active, ongoing defense of your personal data footprint. DoxxScan by GalaxyWarden delivers that defense through continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists who work directly on your exposed information.