Tarolli, Sundheim, Covell & Tummino LLP Listed by Lorenz Ransomware Group

On April 05, 2023, Tarolli, Sundheim, Covell & Tummino LLP appeared on the leak site operated by the Lorenz ransomware group. The law firm, which specializes in intellectual property and patent litigation, was listed as a victim after the attackers claimed to have exfiltrated internal files during a ransomware incident. Anyone whose personal or business records passed through the firm — clients, employees, or their families — may now face long-term exposure.

Reported Details from the Listing

The Lorenz leak site states that the firm suffered a ransomware attack in which internal data was stolen. The listing does not quantify how many records were taken, name the specific systems compromised, or describe the precise data types beyond “internal files.” No ransom demand figure or payment deadline is published on the page. The disclosure simply states that exfiltrated material is available for download by anyone who visits the site, a standard tactic used by the group to pressure victims.

Why This Matters for You and Your Family

When a law firm’s internal files are stolen, the information often includes names, addresses, dates of birth, Social Security numbers, financial details, and correspondence tied to patents, trademarks, or litigation. Even if you never received direct notice, your data may have been included if you were a client, inventor, employee, or vendor. Once posted on a ransomware leak site, that information is permanently public and can be combined with other breaches to build detailed profiles. Families are affected because household addresses, children’s names, and shared email accounts frequently appear in legal and business records.

The Doxxing and Identity-Chain Risks

Stolen internal files create powerful starting points for doxxing chains. Attackers link an email address from one document to usernames on social media, gaming platforms, or shopping sites. A single exposed patent application or court filing can reveal family relationships, home addresses, and phone numbers that are then sold or published. Credential leaks from these incidents routinely cascade into account takeovers, especially for gaming accounts belonging to you or your children. What begins as a corporate breach quickly becomes personal identity theft, harassment, or targeted fraud.

Lorenz Ransomware Group Track Record

Public reporting attributes the first known Lorenz attacks to late 2021. The group has since hit manufacturing, healthcare, professional services, and legal organizations across North America and Europe. Their typical playbook involves initial access through compromised remote desktop credentials or phishing, followed by deployment of ransomware that also exfiltrates data before encryption. Lorenz then uses dual extortion: they threaten to publish the stolen files on their leak site if the victim does not pay. The group maintains an active, well-organized leak portal that updates within days of a new victim listing, keeping pressure high.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by the service.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours rather than months.
• Rotate any password used at Tarolli, Sundheim, Covell & Tummino LLP anywhere it is reused, and switch on 2FA through an authenticator app instead of text messages.
• Cover the entire household with DoxxScan family protection that extends to dependents and children’s gaming accounts vulnerable to credential chaining from this claimed breach.
• Let remediation specialists manage takedown requests for any exposed personal documents appearing on data broker or leak sites.

The incident shows that even specialized professional firms remain targets, and the data they hold can affect clients and their families for years. Starting proactive defense now limits how far attackers can travel down the identity chain. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts.