Ransomware victim disclosure
← All victimsJeffrey Burr
Claimed by anubis · listed 23 hours ago
Status timeline
- Listed
Jun 5, 2026
- Data leaked
At a glance
About the victim
AI dossier — public-source company profileJeffrey Burr appears to be a law firm based on the ransom note's reference to client confidentiality, client dossiers, and the adversary's claim to have accessed internal networks. No public site or additional identifying information is available.
- Industry
- Legal Services
Attack summary
Severity: critical — Confirmed exfiltration of legal client data (dossiers, contracts, correspondence) and financial documents from a law firm. Legal professional privilege and client confidentiality are highly regulated; exposure poses significant harm to clients and the firm.The Anubis group claims to have gained access to the firm's internal network and exfiltrated confidential client data including dossiers, contracts, internal correspondence, and financial documents. The group threatens publication and sale of the data if contact is not made within 48 hours.
Data the group says was taken
AI dossier — extracted from the leak post- client dossiers
- contracts
- internal correspondence
- financial documents
What the group claims
[www.jeffreyburr.com]
The leak post
captured from the group's siteWe will test whether your law firm truly values client confidentiality. We have gained access to the internal network and exfiltrated a substantial volume of confidential data, including client dossiers, contracts, internal correspondence, and financial documents. Now we intend to see whether this firm actually values the trust of its clients — or merely claims to. You have 48 hours to contact us. If we do not hear from you within 48 hours, the full list of exfiltrated data — including categories and volumes — will be published here. After another 48 hours, we will publish an investigative report along with a portion of the data in open access. The remaining data will be sold. We respect business. And we respect those who are willing to make a deal to protect their clients' confidentiality. Please send us an email from any of your company email accounts (we have access to all of them) to [email protected] We will send you instructions on how to resolve this issue.
Sources
Source
Indexed 23 hours agoThis page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.
Is this your supplier? Your competitor? You?
Pro plans monitor your domain, corporate emails, and crypto wallets across every new ransomware leak-site post, breach dump and Telegram callout — alerts within 5 minutes.