What data was stolen in the Falk Waas ransomware attack?

The stolen data includes client case files, medical records, HIPAA-compliant health information authorizations, personal injury documentation, driver licenses, Social Security numbers, W-4 tax forms, legal correspondence, court documents, and financial records from insurance defense cases.

Who is responsible for the Falk Waas attack?

The Rhysida ransomware group claimed responsibility for the attack and is auctioning the stolen data on their dark web leak site for 11 BTC (approximately $1 million USD) with a 7-day auction deadline.

Falk Waas is a premier insurance defense law firm in Florida with over 40 years of experience providing legal representation in personal injury, insurance defense, and litigation matters.

What is the Rhysida ransomware group?

Rhysida is a Ransomware-as-a-Service (RaaS) operation that has been active since October 2024, primarily targeting education, healthcare, non-profit organizations, manufacturing, and legal sectors across the USA, Canada, UK, Brazil, and Germany.

What should affected clients do?

Clients should monitor for identity theft, watch credit reports for suspicious activity, be alert for targeted phishing attempts, consider credit freezes if Social Security numbers were exposed, and report any suspicious activity to authorities.

How many incidents has Rhysida been involved in?

The Rhysida ransomware group has been linked to at least 81 incidents since October 2024, targeting organizations across multiple sectors with a focus on education, healthcare, and professional services.

Florida Insurance Defense Law Firm Falk Waas Hit by Rhysida Ransomware Attack

API Access for Researchers & Security Teams

SOC teams, researchers, and security professionals can integrate Dark Web Informer's threat intelligence directly into their workflows via API. Access real-time breach data, threat feeds, and monitoring capabilities programmatically.

Learn About API Access

Disclaimer

This breach alert includes material that may contain personally identifiable information (PII) gathered strictly from publicly available sources. All information is provided solely for cybersecurity awareness and threat intelligence purposes.

Quick Facts

Date and Time of Alert

2025-12-30 (Auction: 6 days 20 hours remaining)

Threat Actor

Rhysida (Ransomware Group)

Victim Country

United States

Industry

Legal Services / Insurance Defense

Victim Org.

Falk Waas (Falk, Waas, Hernandez, Cortina, Solomon & Bonner)

Victim Site

falkwaas.com

Incident Overview

The Rhysida ransomware group has posted an auction for stolen data from Falk Waas, a Florida-based insurance defense law firm with over 40 years of experience. The leak appeared on Rhysida's dark web site with a 7-day auction countdown and an asking price of 11 BTC (approximately $1 million USD). The ransomware group emphasizes this is an exclusive, one-time sale with no reselling permitted.