Benesch · Breach

[Single source] Silent Ransom Group claims attack on law firm Benesch

Nov 09, 2026 · 1 min read

Silent Ransom Group listed Cleveland-based law firm Benesch, Friedlander, Coplan & Aronoff on its data-leak site, and a second extortion site posted the firm the same day. No data volume or samples have been verified, and Benesch has not confirmed an incident. The group typically targets law firms through callback phishing and fake IT support.

By HIFY Radar newsroom Updated 11/09/2026 12:49 PM Get this every day →← Back to the feed 1 source

LowBreachNo software to update

In 30 seconds

Alleged

Silent Ransom Group (SRG, also tracked as Luna Moth) has listed Benesch, Friedlander, Coplan & Aronoff LLP, the Cleveland-based national law firm behind beneschlaw.com, on its data-leak site, and a second extortion leak site posted the firm the same day. No data volume or samples have been verified, and Benesch has not publicly confirmed an incident, so this remains an unverified threat-actor claim.

Inferred

SRG specializes in targeting law firms, typically gaining access through callback phishing and fake IT-support calls and then stealing client files for extortion without encryption, which means compromised law-firm data could expose privileged client matters across many companies.

What happened

Observed

Silent Ransom Group (SRG, aka Luna Moth) listed Benesch, Friedlander, Coplan & Aronoff LLP (beneschlaw.com), a Cleveland-based national law firm, on its data-leak site, publicly claiming an attack against the firm.

Observed

A second extortion leak site posted the firm on the same day, doubling the public pressure on Benesch.

Observed

No data volume or samples have been verified, and Benesch has not publicly confirmed any incident as of this report.

Why it matters

Inferred

SRG specializes in law firms, and stolen law-firm data can expose privileged client matters across many companies at once, amplifying the potential blast radius far beyond the targeted firm itself.

Inferred

SRG's extortion model relies on stealing client files without encryption, meaning victims face data-leak threats rather than locked systems, which can be harder to detect and can surface sensitive legal communications on public leak sites.

What to do

Inferred

Until Benesch confirms, organizations and observers should treat this as an unverified threat-actor claim, not as confirmation of a breach.

Inferred

Firms should warn staff about unsolicited "IT help desk" calls, the social-engineering vector SRG typically uses to gain initial access via callback phishing and fake IT-support contact.

Confirmed and still uncertain

Observed

Known: SRG listed Benesch on its leak site, a second extortion site posted the firm the same day, and Benesch has issued no public confirmation of an incident.

Inferred

Unknown: the volume of any stolen data, whether client files were actually exfiltrated, the scope of any intrusion, and which client matters might be affected: none of this has been verified, and no samples have been published or checked.

What people are saying

Observed

DailyDarkWeb, the threat-intelligence account that surfaced the listing, cautioned that until the firm confirms, the development should be treated as an unverified threat-actor claim rather than confirmation of a breach.

Observed

Benesch has not publicly commented on the claimed incident, and no statement from the firm or from SRG beyond the leak-site listing appears in the current evidence.

Evolution

Observed

The claim emerged when SRG's data-leak site added Benesch, and a second extortion leak site posted the firm the same day, marking the start of the public extortion pressure.

Inferred

As of this report, there is no confirmed incident, no verified data samples, and no reported escalation such as deadline-based leaks or client notifications.

Reach

Observed

1 independent groups, 1 updates, and 0 engagements.

Technical detail

Inferred

SRG's typical tradecraft involves callback phishing and fake IT-support calls to gain access, followed by theft of client files for extortion without encryption, according to the analyst note accompanying the report.

Observed

The entity named in the listing is beneschlaw.com, the domain of Benesch, Friedlander, Coplan & Aronoff LLP, a Cleveland-based national law firm.

Sources and evidence

Observed

This story is based on a single evidence item: a post by DailyDarkWeb on X reporting SRG's leak-site listing of Benesch and the same-day posting by a second extortion site.

Inferred

The evidence is untrusted open-source reporting: the underlying claim originates from the threat actor's own leak site, and this batch contains no primary confirmation from Benesch, no verified data samples, and no corroborating secondary sources.