A leak of internal chats from Silent Ransom Group (SRG) includes a deal board claiming that 27 law firms paid about $207 million between April 3 and September 24, 2026. The group allegedly worked through phone calls and social engineering, with no file encryption. The number comes from the group's own records, and blockchain analysis supports only its general scale. The account is relayed by SecurityAffairs from DataBreaches reporting.
What the leak contains
Researcher Tammy Harper first passed the material to DataBreaches as an onion site. It holds 5,692 chat messages taken from two of the group's servers, covering about 13 months from August 2025 to September 2026.
Topics include ransom negotiations, ways of getting into victims' systems and how to approach future targets. The chats also drift into personal subjects, among them one member's purchase of an apartment in Moscow, guns and drones.
The money, as claimed
The deal board's figures are the basis for everything below. Crystal Intelligence, which examined the cryptocurrency movements, said on-chain evidence backs the scale of the operation but not the exact amounts.
- Total claimed: about $207 million from 27 firms.
- Median: $6 million per firm, according to SecurityAffairs' arithmetic on the board's numbers.
- Mean: about $7.66 million, lifted by a few very large payments.
- Largest entry: $30 million, attributed in the leak to White & Case.
In the chats, a group leader writes, in Russian, about a "record" payment. The message says that because of the rise in Bitcoin's exchange rate, it "ended up at 31.25 million." The $30 million entry and the 31.25 million figure appear side by side in the reporting.
Cash-out routes
Crystal Intelligence, as relayed by SecurityAffairs, traced several paths for converting the proceeds:
- instant exchangers;
- a cash courier in Moscow;
- a Bitcoin-to-Zelle desk;
- a coin-mixing wallet, used when funds were flagged as suspicious.
The operators set strict wallet rules meant to frustrate tracing, but the chats show those rules were not always followed. Crystal Intelligence also says many smaller payments went directly to regulated exchanges, to accounts tied to verified identities. It calls this the network's weakest point.
Victims and the attack pattern
SecurityAffairs describes SRG's approach as phone calls and deception of employees, who are persuaded to upload documents or share access. Law firms, it notes, hold sensitive client data that criminals could use to press for large payments. The article does not say that such data was used as leverage in each of the 27 cases.
DataBreaches compared 9 of the 27 named victims with public breach disclosures filed in 2026 and found the timing lines up. Two examples:
- Blank Rome disclosed a May incident in which an attacker posing as internal IT convinced an attorney to upload files to an external Google Drive. SecurityAffairs calls it a classic SRG move requiring no malware.
- Goodwin Procter said a single employee was tricked into giving credentials to an unauthorized party.
Entries that don't line up
Two firms show gaps between SRG's notes and the chats. The article reports no response from either firm.
- Hogan Lovells Cadwalader: a chat entry shows a $4 million offer on September 2, matching screenshots the group supplied separately. DataBreaches found no record that the firm paid the full "GOLD" amount SRG claims on its leak site.
- Sheppard: SRG's leak-site notes show an offer near $6 million, but the chat logs give no sign that the firm ever replied to the group.
The group's response
SRG first agreed to be interviewed, then denied that its systems had been breached. On October 9, DataBreaches published a follow-up with further evidence challenging that denial. The dispute is unresolved.
What this means for firms
SecurityAffairs argues that security awareness training may not be keeping pace with these tactics. As editorial analysis, drawn from the described reliance on phone-based deception rather than malware, the exposure sits with staff who can be talked into uploading files or handing over credentials. Verifying unexpected requests that claim to come from IT through a separate channel is a reasonable precaution.
