Wilentz · Breach

[Single source] Silent Ransom Group claims attack on law firm Wilentz

Nov 09, 2026 · 1 min read

Silent Ransom Group (SRG, also known as Luna Moth) listed Wilentz, Goldman & Spitzer, one of New Jersey's largest law firms, on its data-leak site. The entry is marked "to be announced," with no data volume or samples published or verified, and a second extortion leak site also posted the firm. Wilentz has not publicly confirmed an incident.

By HIFY Radar newsroom Updated 11/09/2026 06:18 PM Get this every day →← Back to the feed 1 source

LowBreachNo software to update

In 30 seconds

Observed

Silent Ransom Group (SRG, also tracked as Luna Moth) has listed Wilentz, Goldman & Spitzer, P.A. (wilentz.com): described as one of New Jersey's largest law firms: on its data-leak site, with the entry marked "to be announced." A second extortion leak site also posted the firm the same day.

Alleged

The listing amounts to a threat-actor claim of intrusion and data theft. No data volume or samples have been published or verified, and Wilentz has not publicly confirmed any incident.

What happened

Observed

The threat-intelligence account DailyDarkWeb reported that SRG added Wilentz, Goldman & Spitzer to its data-leak site. The entry carries a "to be announced" marker, meaning no stolen data has yet been attached to the claim.

Observed

In addition to SRG's site, a second extortion leak site posted the firm the same day. As of the report, no data volume or samples had been published or verified, and Wilentz had not publicly confirmed an incident.

Why it matters

Inferred

SRG specializes in law firms, according to the reporting account, and stolen law-firm data can expose privileged client matters spanning many companies. A confirmed breach could therefore ripple well beyond the firm itself, affecting clients across multiple industries.

Inferred

Because SRG typically steals files for extortion without encrypting systems, the primary risk in this scenario is disclosure of confidential client information rather than operational lockup or downtime.

What to do

Inferred

Until the firm confirms, treat this as an unverified threat-actor claim: not confirmation of a breach: as the reporting account itself advises.

Inferred

Monitor SRG's leak site and the second extortion site for the promised "to be announced" update, and watch for a public statement or regulatory notification from Wilentz before drawing conclusions about scope or compromised data.

Confirmed and still uncertain

Observed

Known: SRG (aka Luna Moth) listed Wilentz on its data-leak site with the entry marked "to be announced," and a second extortion leak site posted the firm the same day.

Observed

Unknown: whether an intrusion actually occurred, what data (if any) was taken, the volume of any stolen files, and whether any clients are affected. No samples have been published or verified, and Wilentz has not commented publicly.

What people are saying

Alleged

The only public commentary in the evidence batch comes from DailyDarkWeb, whose analyst note states that SRG "specializes in law firms" and "typically gets in through callback phishing and fake IT-support calls, then steals client files for extortion without encryption."

Alleged

The same account cautions: "Until the firm confirms, treat this as an unverified threat-actor claim, NOT confirmation of a breach."

Evolution

Observed

The public record so far consists of a single day's developments: SRG's leak-site entry marked "to be announced," plus a same-day post on a second extortion leak site. No data dumps, negotiation updates, or firm statements have followed in the available evidence.

Reach

Observed

1 independent groups, 1 updates, and 0 engagements.

Technical detail

Alleged

According to the reporting account, SRG's typical tradecraft is callback phishing followed by fake IT-support phone calls, culminating in file theft for extortion: with no encryption or ransomware deployment.

Observed

The leak-site mechanics observed here are minimal: a victim entry marked "to be announced" on SRG's site, mirrored the same day by a second extortion leak site, with no data attached as yet.

Sources and evidence

Observed

This report rests on a single source: a post by the threat-intelligence account DailyDarkWeb on X. There is no independent corroboration, no statement from Wilentz, and no published data samples in the evidence batch.

Inferred

Single-source reporting on ransomware-leak-site claims carries inherent risk: listings are sometimes used purely as pressure tactics or contain inaccurate claims. Confidence in an actual breach should remain low until Wilentz confirms or verifiable data surfaces.