VULNpocalypse
LowBreach / campaignMonitoring

Falcon ransomware group claims Buchanan Ingersoll & Rooney PC on leak site

Falcon ransomware group claims Buchanan Ingersoll & Rooney PC on its leak site, per RansomLook. It is unconfirmed, so watch for an official notice.

Published
Exploitation
No, not confirmed; the only evidence is a leak-site listing tracked by RansomLook

What happened

According to RansomLook, the Falcon ransomware group added a post titled “Buchanan Ingersoll & Rooney PC” to its leak site on 2026-11-03. RansomLook’s listing describes the post as “182 GB compressed, 260 GB uncompressed”.

This is a claim by the group, not a confirmed breach. The sources do not say that Buchanan Ingersoll & Rooney PC has confirmed any incident. The sources include no independent reporting, and they show no independent verification of the claimed data. The entry point, the type of data, and whether any data was actually taken are not confirmed.

RansomLook records 7 posts by the Falcon group in total, with this listing as the most recent (RansomLook).

Am I affected?

  • Possibly, if you are a client, employee or business contact of Buchanan Ingersoll & Rooney PC. The sources do not show what data, if any, is involved.
  • No product, software version or CVE is named. There is nothing to patch.

What to do now

  1. Watch for direct communication from Buchanan Ingersoll & Rooney PC about whether an incident occurred and who is affected.
  2. Do not download or open files claimed to come from the leak site.
  3. As a general precaution, not drawn from the source, be cautious with unexpected messages that mention Buchanan Ingersoll & Rooney PC or ask for credentials or payment changes.

Sources