Deadlock ransomware actors claim to have stolen sensitive client and transaction files from SHAHEEN LAW GROUP PLC in Virginia, including Social Security numbers, bank wiring details, addresses, family identities, and related documents tied to 150+ monthly real estate closings, plus banking statement attachments and customer folders. The group says the stolen data includes deed records and a client/relocation database for potential resale and impact, threatening exposure of litigation and medical information. #UnitedStates
Incident Details
- Victim: SHAHEEN LAW GROUP PLC – Richmond, Virginia, USA
- Sector: Professional Services
- Country: US
- Actor: Deadlock
- Source:
- Discovered: 2026-08-24T21:21:27.834915+00:00
- Published: 2026-08-24T21:21:26.480350+00:00
Information
- Family law firm in Richmond, Virginia, established in 1995 by Victor A. Shaheen and now run by his three sons.
- Operates across four offices with 48 employees and handles more than 150 real estate transactions every month for major corporate relocation programs.
- Exposure includes highly sensitive client data such as Social Security numbers, bank wiring details, home addresses, family identities, and medical clearance information.
- Claims to have taken 36,788 files totaling 27GB, with 21,789 fully read.
- Reports more than 67,000 SSN patterns, with an internal deduplication count of 6,017 real people.
- Deeds and transaction documents reportedly contain Social Security numbers, names, addresses, and FIRPTA-related sale withholding details.
- Banking and network-related files include internal email headers, server references, and bank statement attachments.
- Client names and transaction details are embedded directly in folder names and file paths.
- Medical and litigation-related files are also mentioned, including a public escrow dispute involving the firm.
- Samples are offered to opposing counsel, journalists, media, and researchers upon request.
Disclaimer: This post is based on public claims made by the ransomware group "Deadlock". I cannot confirm the accuracy of the information. However, I would be happy to share any official statement from the affected organization to provide clarification.