Schmidt Salzman & Moran, Ltd Listed by Akira Ransomware Group

On July 12, 2023, Schmidt Salzman & Moran, Ltd., an Illinois-based real estate tax law firm, was listed on the leak site operated by the Akira ransomware group. The firm, which has represented clients in commercial, industrial, and multi-unit residential property tax matters for 35 years, may have had its internal files exfiltrated during a ransomware attack. The listing states that more than 70GB of data will be uploaded soon and taunts the firm for failing to protect client information that could interest others.

Details from the Akira Listing

The primary disclosure on the Akira leak site states that Schmidt Salzman & Moran, Ltd. suffered a ransomware incident in which internal files were exfiltrated. The posting does not specify the exact number of individuals affected, nor does it list particular categories of records beyond stating that internal files were taken. It promises that more than 70GB of material will be made public if the firm does not meet the group’s demands. No client list, tax records, or correspondence samples appear in the initial posting, though the threat actors claim the volume and sensitivity of the data should concern the firm’s customers.

Public reporting on Akira indicates the group typically uses double-extortion tactics: encrypting victim systems while simultaneously exfiltrating data to pressure payment. In this case the disclosure indicates the firm has not yet paid, prompting the public listing.

Why This Matters for You and Your Family

If you or your family have ever been a client of Schmidt Salzman & Moran, Ltd., your personal or business tax records, property details, financial correspondence, and contact information may now sit in an attacker-controlled archive. Even though the exact data types and record count remain unknown, real estate tax work routinely involves Social Security numbers, driver’s license data, bank routing details, property deeds, and income documentation. Once such material leaves the firm’s control, it can surface on dark-web markets for years.

Ordinary families trying to reduce their property tax burden are exactly the people whose sensitive documents are now at risk. A single leaked tax appeal file can give criminals enough information to file fraudulent returns, open accounts, or impersonate you with county assessors and banks.

The Doxxing and Identity-Chain Risk

Tax and real estate records are high-value connectors in doxxing chains. A single document that links your name, address, phone number, email, and property ownership can be combined with credential leaks from other breaches to build a complete profile. Attackers then target related accounts—especially email, financial portals, and government services—creating cascading identity theft that can affect credit, tax filings, and even children’s records if family members are listed on the same property documents.

Credential leaks of this nature frequently cascade into account takeovers on gaming platforms. Children’s usernames, emails, or parent-linked phone numbers exposed in a professional breach can be reused by attackers to seize Roblox, Fortnite, Steam, or Discord accounts, leading to further personal details being harvested through chat logs and linked payment methods.

Akira Ransomware Group’s Track Record

Public reporting attributes the emergence of Akira to early 2023. The group has since claimed responsibility for attacks on dozens of organizations across North America, Europe, and Australia. Notable prior victims include manufacturing firms, professional services companies, and healthcare providers. Akira typically gains initial access through compromised remote desktop protocol credentials or phishing, exfiltrates data using common file-transfer tools, then deploys its encryptor while preparing the dual extortion demand.

The group’s leak site follows a standard format: victim name, company description, sample screenshots or file trees, and a countdown clock. Like many contemporary ransomware operations, Akira avoids attacking hospitals and charities in public statements, yet its actual victim list shows limited adherence to such self-imposed rules. Its playbook emphasizes speed—listing victims within weeks of initial compromise—and persistent follow-up posting of additional data batches when ransom is not paid.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup of Warden to remove what you can.
• Rotate any password you ever used at Schmidt Salzman & Moran, Ltd. wherever it has been reused, and switch to 2FA through an authenticator app rather than text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your information is caught in hours rather than months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same address or parent email.
• Let remediation specialists handle ongoing takedown requests across data brokers and leak sites on your behalf while you focus on securing day-to-day accounts.

The incident is a reminder that even long-established professional service firms can be compromised with little warning, leaving clients exposed for months or years. Starting proactive defense now limits how far attackers can travel down the identity chain created by this and future breaches. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts at risk from cascading credential leaks.