Pasquetti Sarti & Partners Listed by Malas Ransomware Group

On April 09, 2023, the Italian law firm Pasquetti Sarti & Partners appeared on the leak site operated by the malas ransomware group. The listing states that internal files were exfiltrated during a ransomware attack that leveraged a Zimbra vulnerability. The entry does not disclose the number of affected individuals, the exact volume or types of documents taken, or any ransom demand.

Details from the Leak-Site Listing

The malas leak site, accessible via the .onion address tracked by ransomware.live, lists Pasquetti Sarti & Partners as a “defaulter.” It states the intrusion occurred through an unpatched Zimbra collaboration suite vulnerability and that the attackers successfully removed internal files before encryption. No sample data is shown publicly, and the posting does not quantify records or name specific document categories such as client contracts, billing records, or personal identifiable information. The disclosure indicates the firm did not meet the group’s payment deadline, triggering the public listing.

Why This Matters for You and Your Family

When a law firm’s internal files are stolen, the exposure often includes names, addresses, dates of birth, tax identifiers, financial details, and correspondence that can be traced directly to clients and their households. Even though the exact contents remain undisclosed, any breach of this nature increases the chance that your personal or family information may now be in the hands of criminals. Client data from legal practices is especially valuable because it frequently links multiple family members, shared financial accounts, and estate-planning documents in one convenient package for identity thieves.

The Doxxing and Identity-Chain Risks

Stolen legal files rarely exist in isolation. A single email address or phone number found inside can be correlated with usernames on social media, gaming platforms, or shopping sites. Attackers then build an identity chain that links your professional life to your children’s online handles or shared family cloud storage. Credential leaks of this kind frequently cascade into account takeovers on gaming services, where children’s accounts become entry points for further harassment or extortion. The longer the chain remains unmapped, the higher the risk that one breach quietly fuels months of targeted phishing, SIM-swapping attempts, or doxxing campaigns against you or your family.

Malas Ransomware Group Track Record

Public reporting attributes the malas group with emerging in late 2022 and focusing primarily on small-to-medium professional services firms in Europe and Latin America. Notable prior victims include other law offices and accounting practices, many of which were also compromised via unpatched Zimbra or similar email and collaboration vulnerabilities. Their typical playbook involves initial access through known exploits, rapid exfiltration of documents, followed by double-extortion: first demanding payment to prevent file encryption, then threatening public release of the stolen data if the ransom is not paid. The group’s leak site is used both to pressure victims and to advertise the quality of data available for sale on underground forums.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real-world identity, then use the cleanup of Warden to break those chains.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours rather than months.
• Rotate any password you used at Pasquetti Sarti & Partners or on the Zimbra system anywhere it is reused, and switch to 2FA through an authenticator app instead of SMS.
• Cover the entire household with DoxxScan family protection, which extends to dependents and children’s gaming accounts that often chain back to the same breached address or email domain.
• Let remediation specialists handle ongoing takedown requests for any personal records that surface on data-broker or extortion sites.

The incident underscores that even mid-sized professional firms remain high-value targets when they leave collaboration software unpatched. A forward-looking approach means treating every new breach listing as a prompt to map and lock down your full digital footprint before criminals complete the identity chain. DoxxScan by GalaxyWarden delivers that continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with household coverage that explicitly includes children’s gaming accounts vulnerable to credential-stuffing attacks that follow leaks like this one.