Schaad Listed by Deadlock Ransomware Group

On July 25, 2026, Swiss intellectual property law firm SBMP (Schaad Balass Menzl & Partner AG) was listed on the leak site of the Deadlock ransomware group. The firm, which maintains offices in Zurich and Winterthur and specializes in patent, trademark, and design protection, had internal files exfiltrated during a ransomware attack. The number of individuals whose data appears in the stolen material remains unknown, as neither the leak-site listing nor any subsequent company notification has quantified affected records.

Reported Details from the Listing

The Deadlock leak site explicitly names SBMP and states that internal files were exfiltrated following a ransomware deployment. The disclosure does not specify the volume or exact categories of data taken, nor does it list sample records. Public mirrors of the listing, tracked through ransomware.live, confirm the initial publication date as July 25, 2026. The firm has not yet released a detailed public breach notification, leaving the full scope of exposed information unconfirmed at this time.

Why This Matters for You and Your Family

If you have ever worked with SBMP, filed a patent or trademark through them, or had your personal or business intellectual property matters handled by the firm, your information may now sit in an attacker-controlled archive. Internal files from a specialized law firm frequently contain client names, addresses, contact details, correspondence, financial records related to filings, and technical documentation that can reveal business strategies or personal inventions. For ordinary individuals and families, this creates a direct privacy exposure that can persist for years.

The Doxxing and Identity-Chain Risk

Ransomware operators rarely stop at the initial breach. Once internal files leave the victim’s network, they are often used to map relationships between individuals, companies, and other datasets. A single email address or phone number found in SBMP’s correspondence can be chained with credential leaks from other sources, linking your professional identity to personal accounts, family members, and even children’s online profiles. This is precisely where credential leaks cascade into account takeovers and doxxing chains, especially for gaming accounts that frequently reuse the same passwords or recovery emails used in professional contexts.

Deadlock Ransomware Group Track Record

Public reporting attributes Deadlock with emerging in late 2024 as a ransomware-as-a-service operation that combines double-extortion tactics with selective data leaks. The group has targeted organizations across Europe and North America, with prior victims including manufacturing, legal, and technology firms. Their typical playbook involves initial access through compromised credentials or vulnerable remote desktop services, followed by extensive exfiltration before encryption. They then pressure victims with both ransom demands and the threat of publishing sensitive stolen data on their leak site, often maintaining listings for weeks or months to increase leverage.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, including any connections that may have surfaced from the SBMP files.
• Rotate passwords used with SBMP or any Swiss legal service anywhere they are reused, and immediately enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 15.4B+ breach records and 100+ platforms so the next exposure tied to this incident is caught and flagged within hours.
• Cover the household — DoxxScan family coverage extends to dependents and children’s gaming accounts that often chain back to the same email addresses or recovery information found in professional leaks.
• Let remediation specialists handle ongoing monitoring and takedown requests for any data broker or underground listings that reference information stolen from the firm.

The SBMP listing is a reminder that even specialized professional relationships can expose your family’s personal data long after the initial attack. Staying ahead requires more than reactive checks. DoxxScan by GalaxyWarden delivers continuous monitoring across 15.4B+ breach records and 100+ platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with full household coverage that includes children’s gaming accounts at risk from cascading credential leaks. Acting now limits how far attackers can travel down the identity chain created by this breach.