Morrison Foerster Data Breach

A cyber extortion group the FBI has warned about has posted the name of Morrison Foerster, one of the largest law firms in the country, on its leak site. Law firms hold some of the most confidential information people and businesses ever share.

On Oct. 28, 2026, Silent Ransom Group listed Morrison Foerster on its leak site, according to ransomware.live, a site that tracks these postings. A leak site is where a criminal group names the organizations it claims to have stolen data from, usually to pressure them into paying.

Morrison Foerster, also known as MoFo, is a global law firm headquartered in San Francisco. As of Oct. 29, 2026, the firm has not publicly confirmed a security incident, and Emery | Reddy has not located a notice letter, regulator filing or lawsuit about the report.

Emery | Reddy is investigating the reported breach on behalf of people who may be affected.

The Group Behind the Listing Has Been Hitting Law Firms Since 2023

Silent Ransom Group is not new to the legal industry. On May 26, 2026, the FBI warned that the group, also known as Luna Moth, Chatty Spider and UNC3753, has consistently targeted U.S. law firms since spring 2023.

According to the FBI, the group’s playbook looks like this:

• It uses callback phishing, a scam where a caller poses as a company’s own IT staff or gets an employee to call a fake help line.
• It pushes the employee to allow remote access to their computer.
• If that fails, it may send a person to the office in person.
• It steals data without locking files, then threatens to sell or post the data online.
• It calls the victim’s employees and clients to add pressure.

These are the group’s general methods, as described by the FBI. Emery | Reddy has not seen evidence of how, or whether, Morrison Foerster’s systems were accessed.

Why a Law Firm Listing Raises the Stakes

Clients trust their lawyers with information they share with almost no one else. Law firms typically keep confidential legal, business and personal records for clients and for other people involved in their cases.

That is why groups like this one go after law firms. A firm that faces the threat of client files going public is under heavy pressure to pay. If the group’s claim is true, the people with the most at stake may be clients and others whose information sits in the firm’s files, not only the firm itself.

What Information Is Involved?

That is not known yet. The leak-site listing does not name any types of data, give a record count or include a sample. Morrison Foerster has not disclosed what, if anything, was taken.

If the firm sends notice letters or reports to state attorneys general, those documents would normally list the information involved and the number of people affected. Emery | Reddy is watching for those filings and will update this post.

Has Morrison Foerster Notified Anyone?

Not publicly, as of Oct. 29, 2026. The firm has not announced notice letters, credit monitoring or any other remedy.

Your Information May Be at Risk

Even before any notice goes out, people connected to a listed organization can face real risks. Scammers often use news of a breach to make fake calls and emails that look official. The FBI says this group has called the employees and clients of its targets directly.

Anyone who receives an unexpected call about this incident, or a request for remote access to a computer, should treat it with caution and verify it through a number they already trust.

Do You Have Legal Options?

Organizations that collect personal information may have a legal duty to protect it and to tell people promptly when it is compromised. If Morrison Foerster confirms a breach and your information was involved, you may have rights under state and federal law.

If you are a current or former Morrison Foerster client, employee or job applicant, or you think your information may be in the firm’s files, Emery | Reddy wants to hear from you. A free case review can help you see what you may qualify for.

Call 206.207.8929 or visit www.emeryreddy.com for a Free Case Review. No Fee Unless We Recover.

Your Personally Identifiable Information (PII) includes information that can be used to identify you, such as your name and other personal details. Organizations that manage healthcare data are legally required to safeguard this information. When PII is exposed in a data breach, it can potentially be used by cybercriminals to commit identity theft, financial fraud, or other misuse.

Residents of California may be entitled to additional protections under the California Consumer Privacy Act (CCPA), which provides enhanced rights regarding the collection, use, and safeguarding of personal information.

Frequently Asked Questions

What happened at Morrison Foerster?

On Oct. 28, 2026, Silent Ransom Group listed Morrison Foerster on its leak site, according to ransomware.live. The group lists organizations it claims to have stolen data from. As of Oct. 29, 2026, Morrison Foerster has not publicly confirmed a security incident.

Who is Silent Ransom Group?

It is a cyber extortion group the FBI says has targeted U.S. law firms since spring 2023. It is also known as Luna Moth, Chatty Spider and UNC3753. According to the FBI, it often poses as IT support to get into a company’s systems, then threatens to post stolen data.

How many people are affected?

No number has been disclosed. The listing gives no count, and no notice letters or state filings have been located yet.

What information was involved?

None has been confirmed. If Morrison Foerster sends notice letters, those letters should say exactly what information was involved.

I was a Morrison Foerster client. Should I be worried?

It is too early to say whether any client information was involved. It is reasonable to watch for an official notice and to be careful with any call or email about this incident. You can also request a free case review to learn about your options.

How will I know if my information was involved?

Most states require organizations to notify people when certain personal information is involved in a breach. A notice usually comes by mail or email. Keep any letter you receive, and confirm it really came from the organization before you act on it.

What should I do now?

A few steps can help protect you while more facts come out:

• Watch your mail and email for an official notice.
• Do not give remote access to your computer to anyone who calls claiming to be IT support.
• Be careful with calls or emails that mention this incident. Contact the organization using a number you already trust.
• Check your free credit reports at annualcreditreport.com.
• Report suspicious calls or emails to the FBI at www.ic3.gov.

Can scammers use news of a breach against me?

Yes. Scammers often send emails or make calls that mention a real incident by name to seem believable. They may ask you to “verify” your information or pay a fee. A real organization will not ask for your password or remote access to your device.

Do I have a legal claim?

You may. Organizations that collect personal information may have a duty to protect it and to tell people promptly when it is compromised. If Morrison Foerster confirms a breach and your information was involved, call Emery | Reddy at 916.995.5968 or visit emeryreddy.com for a Free Case Review to see what you may qualify for. No Fee Unless We Recover.