A Maryland family-law firm landed on a ransomware leak site Tuesday. Ransomware.live indexed Milstein Siegel, LLC (milsteinfamilylaw.com) as a claimed victim of the Qilin ransomware group at 2026-10-13 14:22 UTC (about 10:22 a.m. ET), with tracker timestamps pointing to the same day. Pulse and other aggregators mirror the listing; none disclose a data size, ransom, or published file inventory.
The firm's site describes Maryland family-law counsel — divorce, custody, child support, mediation, and related matters — with an Ellicott City address at 6011 University Blvd., Suite 250, and phone (410) 792-2300. The public site was up (HTTP 200) when we checked Wednesday morning.
Tracker note: ransomware.live also carries an older (June 10, 2026) Qilin entry for "Milstein Siegel" under milsteinsiegel.com. Today's article tracks only the October 13 milsteinfamilylaw.com listing. We are not asserting that the June and October entries are the same incident, a re-listing, or separate events — only that the Oct. 13 tracker row exists and remains claim-level.
What's claimed, and what's confirmed
Claimed: Qilin has listed Milstein Siegel, LLC on its leak site against milsteinfamilylaw.com. Aggregators record no disclosed volume and no category inventory in the public mirrors we reviewed. The listing itself is still an actor assertion that the firm is a victim.
Not confirmed: We found no statement from the firm, no mainstream news report, and no Maryland Attorney General, bar, or federal filing tied to this October listing. There is no confirmed encryption, no confirmed theft of client or firm data, no reported case-management outage, and no word on payment. Leak sites are pressure tools. Treat every implication on the listing as unverified until the firm or a regulator says otherwise.
Why it matters to law firms and professional services
Even a lean family-law practice holds trust-account instructions, client financials, custody and domestic records, tax IDs, and e-filing credentials. That mix is exactly what criminals want for identity theft and invoice fraud — and exactly what clients will ask about the hour a headline hits.
Southeast practices in Rome, Atlanta, Chattanooga, and Birmingham run the same stack: Microsoft 365, a practice-management and billing system, a bank portal for IOLTA or operating accounts, and outside vendors with remote access. The fastest damage after a leak-site post is often not encryption. It is a fake "updated wire instructions" email to a client or opposing counsel.
Family-law matters also create long retention clocks: discovery productions, guardian reports, and settlement exhibits can sit for years. If those files live only on one server or one partner laptop, a claim forces an ugly choice between rebuilding from paper and guessing what clients already shared. Continuity planning means knowing which matters are active this week and how you will communicate if the practice-management system is offline.
Clear takeaway
Treat the Qilin claim against Milstein Siegel as a drill for every lean law office. Assume clients will see the headline. Know who speaks for the firm, where the clean backups are, and how you will verify any trust-account or wire change by phone — no matter what a leak site alleges.
Actions to take this week
- Turn on MFA for every attorney and staff account in Microsoft 365 / Google Workspace, practice management, e-filing, and bank portals.
- Check leaked-credential exposure for your domain and force resets on anything that shows up, starting with partners, finance, and IT admins.
- Confirm backups you can restore of matter files, billing, and email — with one copy that cannot be changed or deleted. Test a restore this month.
- Inventory vendor and remote access (IT, bookkeeping, e-discovery, document vendors). Remove shared logins; give each helper a named account with MFA.
- Brief clients and AP: new bank or trust-account instructions get a call-back to a known number, never a reply to the email.
- Write a one-page incident card: who leads, who calls your insurer, carrier, and IT provider, and how you reach clients if email is down.
Brotherly Technology helps law firms and professional-services SMBs across Rome, Northwest Georgia, Chattanooga, and the Southeast turn ransomware headlines into a short readiness review — MFA, backups, vendor access, and payment-change controls. If you want a second set of eyes before the next claim lands, give us a call.
Sources:
- Ransomware.live: Milstein Siegel, LLC / Qilin. Discovered 2026-10-13 14:22 UTC; website milsteinfamilylaw.com; claim-level only.
- Pulse: Milstein Siegel, LLC / Qilin claim. Claim 13 Oct 2026 14:22 UTC; ransom and data size not disclosed.
- Milstein Family Law (milsteinfamilylaw.com). Company context: Maryland family-law firm; Ellicott City office. No incident acknowledgment cited here.
- CISA: #StopRansomware: Qilin (AA24-060A). General Qilin tradecraft; not specific to this firm.