The FBI warns law firms on Silent Ransom. Keeping the client file in house

Law firms can keep privileged client material out of criminal hands by running the systems that touch that material on infrastructure the firm itself controls, and by holding a signed, verifiable record of every access, because the extortion campaigns now aimed at the profession steal and publish files rather than encrypt them. On 26 May 2026 the FBI issued a FLASH alert warning that the Silent Ransom Group has escalated its attacks on law firms, including sending operatives into offices posing as IT support, with data from more than 38 firms already published on the group's leak site. The client file has become the target, and the perimeter around it is now the whole firm.

What did the FBI's May 2026 alert say about the Silent Ransom Group?

The alert warned that the group's methods now extend to physical social engineering, with operatives entering offices posing as IT support, and that data stolen from more than 38 firms has appeared on its leak site. Three details matter. First, the group's leverage is publication, not encryption, so a clean backup does not neutralise the attack. Second, the tradecraft targets people and process as much as software, which means a firewall alone answers the wrong question. Third, the leak site is public proof that the threat is not hypothetical.

Why are law firms such a rich target for data extortion?

Law firms are targeted because they concentrate the most sensitive material of many clients behind a single set of doors. Deal terms, disputes, disclosure sets and personal affairs sit together, and one intrusion yields leverage over every client at once. Publication can undermine privilege, prejudice live matters and hand counterparties material they could never have obtained lawfully. Exfiltration also cannot be undone. Once the file has left the building, nothing returns the confidentiality that was lost. That is why we argue the client file should never be reachable from outside the firm's own perimeter, and every use of it inside should leave evidence.

What does keeping the client file in house actually require?

Keeping the client file in house requires more than hosting documents on a server in the basement. In our view a firm can honestly claim its client data is under its own control when five conditions hold:

• The systems that read, analyse and draft over client material run on hardware the firm owns, inside its own perimeter, not in an external service that processes the file elsewhere.
• The most sensitive matters can be handled fully offline, air-gapped from any external network, so a compromised supplier never becomes a route to the file.
• Every access to a matter, whether by a person or by software acting for one, is written to a tamper-evident record at the moment it happens.
• Sensitive actions require confirmation from a named person, gated by voice biometrics, so possession of a password or a convincing story is not enough to act.
• The keys and identities that authorise those actions are anchored in hardware the firm holds, not in accounts an impostor can reset over the phone.

Measured against that list, the exposure the FBI describes is architectural. An operative posing as IT support succeeds because so much of a modern firm's estate can be reached, and emptied, remotely. Change the architecture and the same visit accomplishes very little.

How does a sovereign operating system shrink the blast radius?

A sovereign operating system shrinks the blast radius by making confidentiality a property of the infrastructure rather than a promise in an engagement letter. MICKAI is a Sovereign Intelligence Operating System, a SIOS, that runs entirely on the firm's own hardware, on premise and air-gapped where the matter demands it, so the intelligence working across matters never becomes another path out of the building. Every action is written to the Open Audit Record, a cryptographically signed, tamper-evident log that is post-quantum secure and verifiable offline, so the firm holds a defensible account of who and what touched a matter. Our cooperative multi-model consensus substrate requires specialist sovereign models to agree before anything material executes, so sensitive steps never run on a single model's judgement, and the most sensitive actions are gated behind voice-biometric confirmation from a named person, anchored to a hardware-held root of trust.

“A confident impostor can talk their way past a reception desk. They cannot talk their way past a voice they do not have and a signed record they cannot alter.”

Against the tradecraft in the FBI's alert, a visitor in a lanyard who reaches a desk still cannot authorise a sensitive action, because authorisation is bound to a registered voice and hardware the firm holds, and every attempt is recorded. We ship one operating system carrying 87 studios, ten production-ready at launch and 77 in development, so a firm can begin with the functions it can govern today and expand as its controls mature. The engineering is the subject of 104 filed UK patent applications across 2,340 claims, although what a client cares about is simpler. The file stays in the building, and the record proves it.

What should managing partners do now?

Managing partners should treat the FBI's alert as a prompt to map every external system that can reach client material, because each one is a potential route to a leak site. Ask three questions. Which suppliers hold or process client files outside the firm's perimeter, and what happens if one is compromised. Would an impostor with a plausible story and a borrowed login pass the tests that guard sensitive matters. And could the firm produce a verifiable record of every access to a matter tomorrow, rather than a reconstruction from scattered logs. Where the honest answers are unknown, yes and no, the remedy is not another policy. It is infrastructure the firm controls, on its own hardware, under its own keys, with evidence built in.

Frequently asked questions

Who is the Silent Ransom Group?

The Silent Ransom Group is a criminal extortion operation that the FBI warned about in a FLASH alert on 26 May 2026. The alert said the group has escalated attacks on law firms, including operatives entering offices posing as IT support, with data from more than 38 firms already published on its leak site.

Why do extortion groups target law firms in particular?

Law firms concentrate the privileged material of many clients in one place, so a single intrusion gives an attacker leverage over every client at once. Publication of stolen files can undermine privilege and prejudice live matters, which is why these groups steal and publish rather than encrypt.

Can an air-gapped system still support day-to-day legal work?

Yes. Our operating system runs fully offline on the firm's own hardware, with sovereign models and the Open Audit Record held inside the firm's perimeter, so research, drafting and analysis continue with no external connection. The most sensitive matters can be worked on in an environment a remote attacker cannot reach.

How does voice-biometric gating help against social engineering?

Voice-biometric gating means sensitive actions require confirmation from a named, registered person, anchored to a hardware-held root of trust, before they run. An intruder posing as IT support may obtain a password or physical access, but they cannot supply the registered voice, and the failed attempt is itself written to the signed record.

What is MICKAI?

MICKAI is a Sovereign Intelligence Operating System (a SIOS) that runs entirely on the customer's own hardware, on premise and air-gapped where required. Every action is recorded in the Open Audit Record, a cryptographically signed, post-quantum secure, tamper-evident log that can be verified offline. It brings together 87 studios on one operating system, with ten production-ready at launch and 77 in development, and its engineering is protected by 104 filed UK patent applications across 2,340 claims, filed rather than granted.