Ransomware group INCRansom has claimed responsibility for compromising LatamLex, a law firm that operates across several Latin American jurisdictions, according to postings observed on its leak site and subsequent threat-intelligence reporting. The gang lists “latamlex (gyg.local)” as a victim, stating that it exfiltrated internal data and is prepared to release it publicly if a ransom is not paid.
Open-source reporting indicates that the criminals are threatening to publish corporate and client information, although there has been no detailed public confirmation from the firm at the time of writing. As with similar ransomware incidents, the risk is not only operational disruption but also exposure of privileged legal communications, internal documents and personal data, which could have regulatory and litigation consequences for clients.
For CISOs in the legal and professional services sectors, the incident is another reminder that firms handling sensitive client data remain prime targets for double-extortion attacks. It reinforces the need for strong identity and access management for remote access and document systems, clear incident response playbooks, and regular client communication plans in case legal privilege or confidentiality is threatened by a breach.
Professional services firms are increasingly targeted by ransomware groups precisely because of the sensitivity of the data they hold, making them more likely to pay ransoms to prevent disclosure. Security experts recommend implementing zero-trust architectures, regular backup verification, and network segmentation to limit the blast radius of potential compromises.
Sources: RedPacket Security, Botcrawl, Ransomware.live
—
By Ji-seo Kim
