The Falcon ransomware group has added Buchanan Ingersoll & Rooney, a large full-service law firm based in Pittsburgh, to its dark-web leak site. The group says it took about 260 GB of data, including what it calls a full export of the firm's Microsoft Dynamics CRM with account and contact records. So far, only the attackers are making this claim. Buchanan Ingersoll & Rooney has not confirmed an incident, no regulator filing or breach notification has been published, and no one has independently checked the data. The firm's public newsroom showed no statement about a cyber incident as of its latest posts in late October 2026. Until that changes, defenders should treat the listing as a credible warning, not as a confirmed breach.
What Happened
Coverage of the listing began on November 3, 2026. HIFY Radar, citing DailyDarkWeb, and Undercode News both reported that Falcon had posted the firm on its leak site. QPulse, citing the Ransomware.live tracker, reported the same 260 GB figure on November 4. All of these reports go back to the attackers' own post.
According to QPulse, the group said the firm "timewasted" during negotiations and warned that "re-attacks" are coming. Databreachrights.com also reports that the group claims it contacted the firm before posting and says the firm put off talking to it. That suggests a ransom demand was made and has not been paid. This is the attackers' version of events, and ransomware groups often use claims like this to put pressure on a victim.
Several things are still unknown: when the intrusion happened, how long the attackers may have been inside, and whether any systems were encrypted or the attack was data theft only. No forensic findings have been made public.
Buchanan Ingersoll & Rooney was founded in 1850. Company data on LinkedIn puts its staff at roughly 700 to 800 people and its annual revenue at $200M to $300M. The firm's public news pages show active practices in international trade, FDA and life sciences, M&A, litigation and real estate. Those are all areas where client data is highly sensitive.
What Was Taken
The reports describe the stolen data in two different ways.
The narrower account. HIFY Radar and Undercode News describe the haul as about 260 GB, centred on a full Microsoft Dynamics CRM export of account and contact records. Undercode News adds that the group gives a compressed size of about 182 GB. That figure most likely refers to the same data in archive form, not a separate dataset.
The broader account. QPulse, citing Ransomware.live, lists a much wider set of files. In addition to the CRM export of names, emails and phone numbers, it lists:
- privileged attorney-client communications
- cost and damages analyses, and settlement strategy communications
- executed M&A documents and signed client NDAs
- internal board presentations, shareholder meeting materials and firm financial projections
- attorney rate sheets and detailed client revenue lists
- exports of user credentials and identity directories
- tax returns and internal personnel alerts
- regulatory correspondence with the FDA and the DOJ
Databreachrights.com gives a similar list, including personnel records. It notes that the number of people affected has not been disclosed.
The total size, 260 GB, is the same in every report. What differs is how much detail each one gives about the contents. Nobody has published samples that have been checked independently, so the full list should be read as the attackers' description, not as verified contents.
Why It Matters
The CRM export is the part that matters most for people outside the firm. For a law firm, a Dynamics CRM holds far more than an address book. It maps which companies the firm represents, who the contacts are on each matter, and where business relationships are heading. In attackers' hands, that is a ready-made list of targets for phishing, business email compromise and extortion aimed at the firm's clients.
If the broader claims are accurate, the damage would be much worse. Settlement strategy, M&A paperwork and correspondence with the FDA and DOJ could be used against clients in litigation or deals, or to extort them directly. Leaked credential and directory exports would also make follow-on intrusions possible, which fits the group's threat of "re-attacks."
The listing also fits a wider pattern. HIFY Radar, citing DailyDarkWeb, reports that Falcon has repeatedly gone after US law firms, including Weitz & Luxenberg and Beasley Allen. Law firms hold the most sensitive data of many clients in one place, and the reputational cost of a leak gives attackers leverage. Both make law firms attractive extortion targets.
The Attack Technique
How the attackers got in has not been disclosed, and no technical indicators have been published. The way the claim is framed around a CRM points to a few possible routes, but none has been confirmed.
One route is a third-party SaaS connection. A full Dynamics export does not require breaking the CRM application itself. In an October 2026 analysis of SaaS attack surface, Breach Authority describes how unmanaged OAuth tokens, service accounts and unused integrations let attackers reach data using permissions the business already granted, without stealing a user's password. The analysis cites Unit 42's 2026 incident response report, which found that preventable gaps, including unmanaged third-party connections, contributed to more than 90% of breaches.
The other route is stolen credentials or a compromised identity system. The claimed credential and directory exports suggest the attackers may have had wide access to the firm's identity systems, which would make a large-scale CRM export easy.
Both are possibilities based on the claimed data, not findings. Until the firm or its responders publish details, the method of entry is unknown.
What Organizations Should Do
- Clients and counterparties of the firm: Expect phishing that uses the firm's name. Any change to invoices, wire instructions or payment details that appears to come from Buchanan Ingersoll & Rooney, or from anyone referring to an active matter, should be confirmed by phone using a number you already have on file.
- Law firms and professional services firms: Review every OAuth grant, service account and third-party connection attached to your CRM and document systems. Revoke unused tokens, remove any scope broader than the task needs, and alert on bulk exports from Dynamics and similar platforms.
- Protect identity systems: Require phishing-resistant MFA for administrators and remote access. Monitor for directory dumps and unusual credential activity, and plan to reset credentials if your own directory may have been exported.
- Watch for large outbound transfers: A 260 GB theft is visible on the network. Set alerts for large or unusual uploads to cloud storage and file-sharing services, especially outside working hours.
- Get ready to notify clients: Prepare a response plan for when privileged data leaks, including who tells clients, how ethics and bar reporting duties are handled, and how state breach notification deadlines are tracked.
- Follow the firm's statements: If you work with Buchanan Ingersoll & Rooney, check its official statements and any regulator filings, and update your risk assessment if the firm confirms the incident or if data samples are verified.
Sources: Falcon ransomware group claims 260 GB theft… HIFY Radar | Ransomware Group Falcon Claims Data Exfiltration from Buchanan Inge... | Buchanan Ingersoll Data Breach Claim: What to Know | Falcon Ransomware Claims 260GB Data Theft From US Law Firm Buchanan... | Buchanan News Buchanan Ingersoll & Rooney PC | New York City Lawyers Buchanan Ingersoll & Rooney PC | Garrett Maw | Fingerprinting Third-Party SaaS Integrations as Attack Vectors · Br...