Luna Moth, the data-theft extortion crew also tracked as Silent Ransom Group and Chatty Spider, is reportedly extorting global law firm Jones Day alongside WilmerHale, with a $13 million demand tied to stolen client and matter files. The claim comes from a single lower-tier source, vpn.social, and neither firm has published a statement confirming it. What is far better corroborated is the campaign around it: Law.com and Non-Billable both report that a cluster of Am Law firms including Weil Gotshal & Manges, Goodwin Procter and WilmerHale have collectively paid roughly $50 million in ransoms this year, with individual figures reported at about $20 million (Weil), at least $18 million (WilmerHale) and around $10 million (Goodwin). Those payment figures sit awkwardly against the reported $13 million Jones Day demand, and we flag the gap rather than reconcile it. Treat the Jones Day specifics as unconfirmed and the sector-wide targeting of Big Law as established.
What Happened
Reporting across the legal trade press describes a sustained extortion campaign against large law firms running through mid-2026. Law.com reported on 11 August that Herbert Smith Freehills Kramer, Mayer Brown and Goodwin Procter were among a growing list of firms disclosing breaches to regulators. HSF Kramer filed with Vermont regulators on 29 July describing a US-office incident involving Social Security numbers, government IDs and health records, and told Non-Billable that the incident was "investigated and contained" and that "the small number of people affected have been notified."
Mayer Brown's account is materially different in kind. The firm told Law.com that "one of our personnel mistakenly sent a small number of documents to an unauthorized third party who misrepresented their identity," and that its investigation "confirmed that this was an isolated incident and that the third party did not access our systems." That is pretext and social engineering rather than intrusion, and it is worth keeping separate from the Luna Moth exfiltration cases even though both land in the same news cycle.
The Jones Day and WilmerHale $13 million claim rests on vpn.social alone. Non-Billable, citing The Insurer, separately reports WilmerHale as having paid at least $18 million to Luna Moth. Those two accounts are not compatible on their face: one describes an outstanding demand, the other a completed payment at a higher number. Absent a firm statement or regulatory filing, the honest position is that accounts differ on both the amount and the status of the WilmerHale matter.
Separately, and predating the extortion reporting, Jones Day issued its own public warning in June about criminals impersonating its lawyers and the firm across email, text, phone, messaging apps, social media and fraudulent websites. That advisory is about fraud committed in the firm's name rather than a breach of the firm, but impersonation of a named law firm is precisely the raw material a callback-phishing operation needs.
What Was Taken
For the Jones Day and WilmerHale matters, no source provides a record count, a document volume or a data-type inventory. vpn.social characterises the material generically as stolen client and matter data. We are not going to invent precision that the sourcing does not support.
Where firms have filed with regulators, the picture is sharper. HSF Kramer's Vermont filing covers Social Security numbers, government-issued IDs and health records taken from the firm. Mayer Brown describes a small number of documents released to a third party under false pretences.
The adjacent financial-sector campaign gives a sense of what confirmed disclosure looks like in this wave. Apollo Global Management filed a breach notification with the California attorney general covering unauthorised access to cloud platforms between 6 and 10 July; the firm determined on 12 August that names, dates of birth, contact information, home addresses and Social Security numbers were compromised. Apollo has not stated how many people are affected, and reports its assets under management differently across outlets, at $938 billion per TechCrunch's reading of public filings and $1.05 trillion as of end-June per the regulatory filing CyberScoop cites. Apollo says it has found no evidence the data has been posted online or used for fraud.
The value of law-firm data is not measured in record counts anyway. Pre-announcement merger detail, litigation strategy, privileged communications and personal records for high-profile clients are leverage precisely because a single document can be worth more than a million rows of consumer PII.
Why It Matters
Luna Moth's model removes encryption from the equation. There is no payload, no lockout, no red screen. The group steals files and threatens publication. Backups, immutable snapshots and disaster-recovery runbooks are all irrelevant to that threat model, because nothing was destroyed and nothing needs restoring. The only control that matters is stopping the copy from leaving.
The economics are the second problem. If the reported figures hold, Big Law paid roughly $50 million to a single extortion ecosystem in one year, with individual payments in the eight figures. That is a demonstrated willingness to pay at a scale that guarantees continued targeting. A firm whose entire product is confidentiality has a structurally weaker negotiating position than a retailer, and the actors know it.
Third, this is not one crew. The sources describe at least three distinct operations running similar social-engineering playbooks in parallel: Luna Moth against law firms; BlackFile, a group Google attributes to The Com and which CyberScoop reports has split its extortion into four brands (Redact, Pink, Helix and Falcon) on shared infrastructure, against private equity, financial ratings agencies and medtech; and the ShinyHunters-associated activity Microsoft documented against SaaS tenants. Reuters reported Blackstone, Bridgewater and Bain Capital among the targeted financial firms, though it was unclear whether any were successfully breached. Voice phishing has become the common entry technique across otherwise unrelated actors.
The Attack Technique
Per vpn.social, citing Aardwolf Security, Luna Moth intrusions begin with a phone call rather than malware. Reception desks, help desks and staff handling routine inbound calls are the entry point. Once a foothold exists and files are exfiltrated, the group skips directly to the extortion demand: pay or the documents publish. Note that this specific technical description traces to lower-tier sourcing and should be held loosely.
Microsoft's July advisory on ShinyHunters-associated OAuth abuse is the PRIMARY-tier document in this set and describes the mature version of the same social-engineering front end. Microsoft observed two main intrusion paths between mid-2025 and mid-2026: vishing aimed at obtaining OAuth consent, and supply-chain compromise through trusted integrations such as Salesloft and Gainsight. Both routes inherit user and application privileges, which lets the actor enumerate and query CRM records at scale while evading conventional authentication detections and maintaining persistence. Microsoft is explicit that this was not a Salesforce vulnerability; the trusted OAuth relationship itself was the abused asset. Microsoft says it worked with Salesforce to improve telemetry granularity in Defender for Cloud Apps, adding near-real-time detection with connected-application attribution.
Apollo's disclosure fits the same shape from the victim side. Attackers reached cloud platforms via social engineering, held access for roughly five days, and took HR-grade personal data. Apollo's global head of human capital, Matthew Breitfelder, wrote that the firm "promptly notified law enforcement, engaged leading outside cybersecurity and forensic experts, enhanced our security protocols, and launched an investigation." Apollo did not name the responsible group and did not say how it detected the intrusion.
The through-line is that the perimeter being attacked is a human on a phone, and the crown jewels being reached are in SaaS and cloud tenants rather than on-premise file servers.
What Organizations Should Do
-
Harden the help desk against voice pretexting. Require out-of-band verification before any password reset, MFA re-enrolment, device registration or access grant. Callback to a number from the directory, not a number the caller supplies. Log every identity-verification exception and review them weekly. This is the single control that would break the reported Luna Moth chain.
-
Treat OAuth consent as a privileged operation. Following Microsoft's guidance, disable end-user consent for third-party applications, run an admin consent workflow, and inventory every connected app with its granted scopes. Revoke tokens for anything unrecognised, unused or over-permissioned, and re-attest the inventory on a schedule.
-
Enable and actually monitor SaaS-tenant telemetry. Turn on Salesforce event monitoring and equivalent audit logging in every major SaaS platform. Alert on bulk record export, unusual API query volume, first-seen connected applications and access from new infrastructure. Apollo's attackers had roughly five days inside a cloud environment.
-
Instrument for exfiltration, not encryption. Because Luna Moth never encrypts, ransomware-specific detections will never fire. Baseline normal document-repository and DMS access per user and matter, then alert on volumetric reads, mass downloads and transfers to file-sharing and cloud-storage services.
-
Audit third-party and integration risk. Microsoft observed compromise arriving through trusted workflows such as Salesloft and Gainsight. Map which vendors hold standing tokens into your environment, scope those tokens to the minimum required, and require breach notification terms that trigger token rotation.
-
Rehearse the no-encryption extortion scenario. Run a tabletop where nothing is down, everything works, and an actor emails partners a sample of privileged client documents with a 72-hour deadline. Decide in advance who negotiates, when clients and insurers are told, what the regulatory notification clock looks like across jurisdictions, and who signs off on payment. Firms making eight-figure decisions under deadline pressure should not be making them for the first time.
-
Watch for impersonation of your own brand. Jones Day's June advisory is a reminder that a firm's name, letterhead and attorney roster get weaponised against clients and counterparties. Monitor for lookalike domains, publish a verification path on your own site, and tell clients how you will and will not contact them.
Sources: Luna Moth Hits Jones Day, WilmerHale With $13M Demand — vpn.social | Defending SaaS-based applications against ShinyHunters OAuth abuse... | Private equity firm Apollo confirms data breach amid hacking wave t... | Apollo discloses data breach from ongoing wave of attacks hitting f... | Big Law hackers pocket $50m in ransoms this year as fresh breaches... | HSF Kramer, Mayer Brown Targeted in Latest Law Firm Data Breaches... | BigLaw Firms Face New Data Breaches | Jones Day Scam or Legit? Warning