Greenberg Traurig protects attorney-client privilege for a living. It could not protect 126,000 people's Social Security numbers.

On 13 August 2026, the extortion group Silent Ransom Group, also tracked by researchers as Luna Moth, gained access to a corporate iPad belonging to an employee at Greenberg Traurig, LLP, a Miami-based law firm with offices across the United States and internationally. Neither Greenberg Traurig nor Silent Ransom Group has said publicly how the device was compromised. The group's usual method, documented across dozens of law firm intrusions this year, starts with an invoice-themed email containing no malicious link at all, only a phone number. A follow-up call from someone posing as internal IT support talks the employee into opening a remote support session and installing a legitimate tool such as AnyDesk, Zoho Assist or Microsoft Quick Assist. Whatever the exact route into Greenberg Traurig's network, the outcome was the same: an employee let in someone who was not who they claimed to be.

Silent Ransom Group reportedly infected devices belonging to five separate employees before the intrusion was detected on 26 August, thirteen days after the initial access. The group's typical routine once inside is to search document management systems and cloud storage for contracts, tax records and other sensitive files, then move the data out using tools such as WinSCP or Rclone. Extortion demands usually follow within half an hour of the operators leaving the network, with a three-day deadline attached to them.

Greenberg Traurig received a ransom demand reportedly in the eight figures. Negotiations opened on 27 August, but the firm stalled, asking for more time and querying how the figure had been calculated. When the deadline passed without an offer, Silent Ransom Group published the stolen files on 2 September. The dataset covers roughly 126,000 people: names, dates of birth, postal and email addresses, phone numbers and Social Security numbers, plus job titles, departments and hourly rates for Greenberg Traurig's own staff. For a number of the firm's partners and counsel, the exposed files reportedly went further, including credit reports, tax returns, medical records and passport information.

Greenberg Traurig has not disclosed a total financial cost, and the eight-figure ransom demand was never independently confirmed. What is confirmed, through regulatory filings in California and Vermont, is that Social Security numbers and other personal data belonging to residents of both states were among the material taken. Silent Ransom Group has run close to the same playbook against other US law firms and professional services firms this year: an invoice email, a callback, a fake IT technician, a legitimate remote access tool turned against the person who installed it. The FBI issued a specific warning about the group targeting law firms in 2025. Greenberg Traurig is simply the largest name attached to it so far.

The defences that failed here were not weak by conventional standards. Greenberg Traurig is a firm built around confidentiality: privilege logs, conflict checks, need-to-know access controls on client files. None of that mattered once one employee, on one device, accepted a phone call from someone claiming to be internal IT. Endpoint protection, email filtering and staff training all assume the attacker is trying to get past a technical control. Silent Ransom Group's entire method is built to avoid technical controls altogether, by getting a real employee to hand over access voluntarily, one apparently ordinary support call at a time.

Installing a remote access tool on a firm device, at the request of someone claiming to be IT support, is an execution event. Under GoFirm, that action does not complete on the strength of a phone call alone. Before the installation proceeds, or before any new device or session is granted access to the firm's network, a confirmation request goes to the named authority responsible for that approval, sent directly to their registered device, not to whatever number or channel the caller has supplied.

Approving that request requires a live biometric confirmation on hardware Silent Ransom Group has never touched. The caller can sound exactly like the firm's IT department. They can reference real employee names, real ticket numbers, real internal jargon. None of that produces a fingerprint or a face on a device the attacker does not hold.

A vishing call, however convincing, cannot produce that confirmation. The execution boundary holds regardless of how credible the impersonation appears.

GoFirm is The Authority Platform. Stop unauthorised action. Every time.

In association with Osinto.ai, the collective intelligence and governance network for Security, Resilience & Defence teams.

References

1. DataBreaches.Net. 2026. Silent Ransom Group hacked Greenberg Traurig; who notifies the 126k affected? DataBreaches.Net, 14 September 2026.
2. OODA Loop. 2026. Law firm Greenberg Traurig says 'limited' data posted to dark web as cyber attacks mount. OODA Loop, 11 September 2026.
3. BleepingComputer. 2026. Silent Ransom Group targets law firms with fake IT support calls. BleepingComputer, 7 June 2026.