Silent Ransom Group allegedly extorted about $207 million from 27 law firms between April 3 and September 24, according to an analysis of leaked chats reported by DataBreaches and Tammy Harper. The group is said to have done it without malware or encryption, relying on phone calls and social engineering. The figures remain unverified.
$207 Million in Alleged Payments Across 27 Law Firms
The leaked material covers August 2025 through September 2026, and the alleged payments fall between April 3 and September 24, 2026. The analysis puts the median payment at $6 million, the mean at $7.66 million and the largest at $30 million, attributed to White & Case.
A partial list of victims was verified: Blank Rome, Goodwin Procter, Hogan Lovells Cadwalader, Sheppard and White & Case. The evidence consists of 5,692 leaked chat messages about victim payments and targeting. The reporting calls the haul the largest known pure-extortion campaign against law firms.
How Silent Ransom Group Extorts Without Encryption
The method is social engineering by phone. Operators call employees, impersonate IT staff, and persuade them to upload files or share credentials. No malware is used and no files are encrypted. The pressure comes from the stolen data and the confidentiality of law firm clients, whose information is exposed if the firm does not pay.
Crystal Intelligence Questions the Exact Figures
Crystal Intelligence, which examined blockchain data, said the on-chain evidence supports the scale of the payments but not the exact figures in the chats. The company also found that some firms claimed as victims show no evidence of payment.
These caveats leave the total as an allegation. The chat messages are the main source, and the blockchain analysis corroborates the general size without confirming each amount.
No Law Enforcement Action Cited Against Silent Ransom Group
No law enforcement action was cited in the reporting. The $207 million total, the per-firm amounts and the full list of 27 victims have not been independently confirmed. Only the partial list of five firms is described as verified.
Client Confidentiality Exposed
The impact described is the exposure of client confidentiality. Law firms hold sensitive information for their clients, which gives stolen documents strong bargaining power in an extortion negotiation.
The leaked chats cover a period of roughly thirteen months, from August 2025 to September 2026, while the alleged payments fall within a shorter span of about five and a half months. That difference means the chats include activity outside the payment window, such as targeting discussions.
The method also bears on how the victims were breached. Since the operators relied on employees uploading files or handing over credentials after a call from someone posing as IT staff, the entry point was a person rather than a software flaw. There is therefore no patch or indicator-based fix associated with these intrusions in the reporting.
The reporting does not name the individuals behind the group or state whether any of the named firms confirmed paying. The five firms listed are described as a verified partial list of victims, not as confirmed payers, and the distinction matters given Crystal Intelligence’s finding that some claimed victims show no payment evidence.
What the Leaked Chats Cover
The 5,692 messages come from leaked chat records that discuss victim payments and targeting. The data window is wide, running from August 2025 to September 2026, which lets analysts compare the group’s talk about targets with the payment amounts recorded in the same period.
Those payment amounts form the basis for the statistics reported by DataBreaches and Tammy Harper: a median of $6 million, a mean of $7.66 million and a top payment of $30 million. The mean sitting above the median indicates a few large payments pulling the average up, with the $30 million figure the largest.
Crystal Intelligence Blockchain Check
Crystal Intelligence’s review of blockchain data is the only independent check cited. It supports the scale of the flows while declining to confirm exact amounts, and it found no payment evidence for some of the firms named as victims.
