DataBreachesDissent
Hogan Lovells Faces Repeat Ransomware Attack After $20m Demand
Part of the Luna Moth story · since 7 Apr
- Tue 7 Apr, 03:01 UTC. DataBreaches, first report. Jones Day confirms breach after Silent Ransom Group phishing.
- Fri 10 Apr, 15:07 UTC. DataBreaches. Law firm Orrick hit by SRG hack, data leaked after ransom talks.
- Mon 13 Apr, 17:21 UTC. DataBreaches. Silent Ransom Group targets US law firms, leaks data from 38+.
- Wed 27 May, 08:51 UTC. SecurityWeek, its first report on the story. FBI warns Silent Ransom Group targeting US law firms via phishing.
- Wed 27 May, 13:21 UTC. DataBreaches. FBI Warns of Silent Ransom Group Targeting US Law Firms.
- Wed 27 May, 21:21 UTC. Dark Reading, its first report on the story. FBI warns Silent Ransom Group targets law firms with IT scams.
- Fri 29 May, 13:10 UTC. Infosecurity, its first report on the story. Ransomware gang poses as IT staff to hit US law firms.
- Fri 5 Jun, 18:31 UTC. Security Affairs, its first report on the story. FBI warns that Silent Ransom Group uses IoT devices in attacks.
- Sun 7 Jun, 19:30 UTC. DataBreaches. Silent Ransom Group spurns $1.8M demand, leaks law firm data.
- Mon 8 Jun, 10:40 UTC. SecurityWeek. Silent Ransom Group uses fast flux to hit law firms worldwide.
- Mon 8 Jun, 11:50 UTC. Security Affairs. UNC3753 gang uses vishing and USB drops to steal legal data.
- Mon 8 Jun, 21:30 UTC. Dark Reading. Silent Ransom Group Targets Law Firms Using Vishing to Steal Data.
- Mon 29 Jun, 23:06 UTC. DataBreaches. Silent Ransom Group hits Fox Rothschild, leaks law firm data.
- Fri 21 Aug, 17:06 UTC. DataBreaches. Troutman Pepper Locke Suffers Second Silent Ransom Attack.
- Mon 14 Sep, 13:41 UTC. DataBreaches. Ransom Group Claims Greenberg Traurig Breach Exposed 126,000 People.
- Mon 28 Sep, 17:47 UTC. DataBreaches. Hogan Lovells Faces Repeat Ransomware Attack After $20m Demand. This article, 16th of 22.
- Wed 7 Oct, 22:36 UTC. DataBreaches. Leaked SRG Chats Claim $207 Million in Ransom Payments from Law Firms.
- Fri 9 Oct, 14:36 UTC. DataBreaches. Researchers question whether the Luna Moth leak really came from Silent Ransom Group.
- Sat 10 Oct, 15:55 UTC. Security Affairs. Silent Ransom Group Extorted 27 Law Firms Without Using Malware.
- Sun 11 Oct, 14:01 UTC. DataBreaches. Unprotected MongoDB Backup Exposed Silent Ransom Group Chats.
- Mon 12 Oct, 15:37 UTC. Infosecurity. Leaked files reveal how Luna Moth scammers trick staff into granting remote access.
- Thu 12 Nov, 21:30 UTC. Dark Reading. Luna Moth returns to law firms to steal Microsoft tokens.
DataBreaches.net has reported that Silent Ransom Group (SRG) allegedly breached Hogan Lovells’ legacy infrastructure on 12 August 2026, remaining in the network for about 24 hours and taking data from several machines. The report says the infrastructure had separate firewalls, file systems and security controls, but does not identify the tools used. SRG contacted the firm on 25 August, and negotiations followed.
Hogan Lovells reportedly offered up to $5.34m, while SRG demanded at least $20m and ended talks on 21 September. The firm did not respond to DataBreaches’ requests for comment, so the breach remains unconfirmed, although the publication said its inspection found no indication that the data had been fabricated.
According to SRG, the first tranche contained more than 50GB of data, including about 500 passports, driving licences and Social Security numbers. DataBreaches said it found more than 930 files marked “Privileged and Confidential”, along with medical records, tax forms containing full Social Security numbers, and other sensitive documents.
On 23 September, SRG allegedly regained access using the same method and took additional data, including internal documents and emails, valid passports, credit and personal information, and detailed financial records. SRG said it would publish the second tranche and warned that it would continue attacking the firm until its demands were met. The report notes that SRG has previously carried out repeat attacks, but does not independently confirm either incident.
How the story developed
22 articles from 5 outlets since 7 Apr. Picked up again on 12 Nov after 4 weeks quiet. This was the 16th report, 175 days after the first.
- Tue 7 Apr, 03:01 UTC. DataBreaches, first report. Jones Day confirms breach after Silent Ransom Group phishing.
- Fri 10 Apr, 15:07 UTC. DataBreaches. Law firm Orrick hit by SRG hack, data leaked after ransom talks.
- Mon 13 Apr, 17:21 UTC. DataBreaches. Silent Ransom Group targets US law firms, leaks data from 38+.
- Wed 27 May, 08:51 UTC. SecurityWeek, its first report on the story. FBI warns Silent Ransom Group targeting US law firms via phishing.
- Wed 27 May, 13:21 UTC. DataBreaches. FBI Warns of Silent Ransom Group Targeting US Law Firms.
- Wed 27 May, 21:21 UTC. Dark Reading, its first report on the story. FBI warns Silent Ransom Group targets law firms with IT scams.
- Fri 29 May, 13:10 UTC. Infosecurity, its first report on the story. Ransomware gang poses as IT staff to hit US law firms.
- Fri 5 Jun, 18:31 UTC. Security Affairs, its first report on the story. FBI warns that Silent Ransom Group uses IoT devices in attacks.
- Sun 7 Jun, 19:30 UTC. DataBreaches. Silent Ransom Group spurns $1.8M demand, leaks law firm data.
- Mon 8 Jun, 10:40 UTC. SecurityWeek. Silent Ransom Group uses fast flux to hit law firms worldwide.
- Mon 8 Jun, 11:50 UTC. Security Affairs. UNC3753 gang uses vishing and USB drops to steal legal data.
- Mon 8 Jun, 21:30 UTC. Dark Reading. Silent Ransom Group Targets Law Firms Using Vishing to Steal Data.
- Mon 29 Jun, 23:06 UTC. DataBreaches. Silent Ransom Group hits Fox Rothschild, leaks law firm data.
- Fri 21 Aug, 17:06 UTC. DataBreaches. Troutman Pepper Locke Suffers Second Silent Ransom Attack.
- Mon 14 Sep, 13:41 UTC. DataBreaches. Ransom Group Claims Greenberg Traurig Breach Exposed 126,000 People.
- Mon 28 Sep, 17:47 UTC. DataBreaches. Hogan Lovells Faces Repeat Ransomware Attack After $20m Demand. This article, 16th of 22.
- Wed 7 Oct, 22:36 UTC. DataBreaches. Leaked SRG Chats Claim $207 Million in Ransom Payments from Law Firms.
- Fri 9 Oct, 14:36 UTC. DataBreaches. Researchers question whether the Luna Moth leak really came from Silent Ransom Group.
- Sat 10 Oct, 15:55 UTC. Security Affairs. Silent Ransom Group Extorted 27 Law Firms Without Using Malware.
- Sun 11 Oct, 14:01 UTC. DataBreaches. Unprotected MongoDB Backup Exposed Silent Ransom Group Chats.
- Mon 12 Oct, 15:37 UTC. Infosecurity. Leaked files reveal how Luna Moth scammers trick staff into granting remote access.
- Thu 12 Nov, 21:30 UTC. Dark Reading. Luna Moth returns to law firms to steal Microsoft tokens.
- No CVE
- Larger: an outlet’s first report
- Coverage over time
- Quiet time, folded
Show all 22 articles as a listHide the list
- Tue 7 AprDay 01
- Jones Day confirms breach after Silent Ransom Group phishing03:01 · DataBreaches · First report
Quiet for 4 days
Fri 10 AprDay 31- Law firm Orrick hit by SRG hack, data leaked after ransom talks15:07 · DataBreaches · Picked up again
Quiet for 3 days
Mon 13 AprDay 61- Silent Ransom Group targets US law firms, leaks data from 38+17:21 · DataBreaches · Picked up again
Quiet for 6 weeks
Wed 27 MayDay 503- FBI warns Silent Ransom Group targeting US law firms via phishing08:51 · SecurityWeek · Picked up again
- FBI Warns of Silent Ransom Group Targeting US Law Firms13:21 · DataBreaches
- FBI warns Silent Ransom Group targets law firms with IT scams21:21 · Dark Reading
Quiet for 2 days
Fri 29 MayDay 521- Ransomware gang poses as IT staff to hit US law firms13:10 · Infosecurity
Quiet for 7 days
Fri 5 JunDay 591- FBI warns that Silent Ransom Group uses IoT devices in attacks18:31 · Security Affairs · Picked up again
Quiet for 2 days
Sun 7 JunDay 611- Silent Ransom Group spurns $1.8M demand, leaks law firm data19:30 · DataBreaches · Picked up again
- Mon 8 JunDay 623
- Silent Ransom Group uses fast flux to hit law firms worldwide10:40 · SecurityWeek
- UNC3753 gang uses vishing and USB drops to steal legal data11:50 · Security Affairs
- Silent Ransom Group Targets Law Firms Using Vishing to Steal Data21:30 · Dark Reading
Quiet for 3 weeks
Mon 29 JunDay 831- Silent Ransom Group hits Fox Rothschild, leaks law firm data23:06 · DataBreaches · Picked up again
Quiet for 8 weeks
Fri 21 AugDay 1361- Troutman Pepper Locke Suffers Second Silent Ransom Attack17:06 · DataBreaches · Picked up again
Quiet for 3 weeks
Mon 14 SepDay 1601- Ransom Group Claims Greenberg Traurig Breach Exposed 126,000 People13:41 · DataBreaches · Picked up again
Quiet for 2 weeks
Mon 28 SepDay 1741- Hogan Lovells Faces Repeat Ransomware Attack After $20m Demand17:47 · DataBreaches · Picked up again · This article, 16th of 22
Quiet for 9 days
Wed 7 OctDay 1831- Leaked SRG Chats Claim $207 Million in Ransom Payments from Law Firms22:36 · DataBreaches · Picked up again
Quiet for 2 days
Fri 9 OctDay 1851- Sat 10 OctDay 1861
- Silent Ransom Group Extorted 27 Law Firms Without Using Malware15:55 · Security Affairs
- Sun 11 OctDay 1871
- Unprotected MongoDB Backup Exposed Silent Ransom Group Chats14:01 · DataBreaches
- Mon 12 OctDay 1881
Quiet for 4 weeks
Thu 12 NovDay 2191- Luna Moth returns to law firms to steal Microsoft tokens21:30 · Dark Reading · Picked up again