A small New York real estate and commercial law firm showed up on a ransomware leak-site tracker Monday evening. Ransomware.live indexed Rosenberg & Pittinsky, mapped to rpllplaw.com, as a claimed victim of the Global Secret Group at 2026-10-19 22:23 UTC (about 6:23 p.m. ET Monday), with an estimated attack date of Oct. 19. The group's post claims 430 GB (218,361 files in 6,630 folders) and lists the firm's industry as legal services, real estate, and commercial litigation.
That domain belongs to Rosenberg & Pittinsky, LLP, a general-practice firm founded in 1998. Its website lists an office at 15 South Bayles Avenue in Port Washington, New York (the group's post gives a Manhattan ZIP code), and describes work across New York City, Nassau, Suffolk, and Westchester counties and parts of New Jersey: real estate transactions, landlord/tenant and commercial litigation, business sales, leasing, collections, appeals, and general counsel work for condominiums and co-ops. The public site was up (HTTP 200) when we checked Tuesday morning. We are writing about this firm only, not any other business with a similar name.
What's claimed, and what's confirmed
Claimed: Global Secret Group added the firm to its leak site with a size and file-count figure, plus revenue and headcount estimates that read like scraped business-directory data. A listing is an actor assertion. It is not proof of what was taken, whose files are involved, or whether any systems were encrypted. Tracker pages also show DNS records and third-party credential-exposure counts for the domain. Those are routine lookups, not evidence of how or whether an intrusion happened.
Not confirmed: As of Tuesday morning we found no statement from Rosenberg & Pittinsky, no news report confirming an incident, and no New York attorney-general or other regulator notice. There is no confirmed encryption, no confirmed theft of client files or personal information, no reported disruption to closings or court deadlines, and no word on any payment. Treat this as a claim until the firm says otherwise.
Why it matters to real estate and commercial law firms
Real estate practices move money and documents on deadlines: contracts of sale, closing statements, escrow and IOLA instructions, payoff letters, leases, and co-op board packages. That makes them a favorite target for wire fraud even when nothing has been encrypted. Criminals don't need stolen files to send a convincing "updated wiring instructions" email to a buyer, a lender, or a managing agent.
After any leak-site listing that names a firm, everyone on the other side of its deals (clients, title agents, lenders, opposing counsel, and boards) should slow down. Confirm any change to wiring or payoff details with a phone number you already have on file, never the one in the email. For small firms across New York, Georgia, Tennessee, and Alabama, the defense looks the same: MFA on email and document systems, tested backups, and a written call-back rule for every disbursement.
Ask the practical question: if email and the document system were offline the week of a closing, could the firm still reach the title company, confirm wires by phone, and meet its court dates?
Clear takeaway
Treat Global Secret Group's claim against Rosenberg & Pittinsky (rpllplaw.com) as a continuity and wire-verification drill for small real estate and commercial law firms. Protect MFA on Microsoft 365 and document systems, keep restorable backups of client files, and require voice call-backs before any escrow or payoff change, no matter what a leak site alleges.
Actions to take this week
- Require MFA on email, document-management and e-filing accounts, remote access, and bank and escrow portals. Turn off legacy sign-ins that skip MFA.
- Check leaked-credential exposure for your domain and force resets on anything that shows up, starting with partners, paralegals, and anyone who can release funds.
- Confirm backups you can restore of client files, closing folders, and accounting data, with one copy that cannot be changed or deleted. Test a restore this month.
- Write a wire rule: no escrow, IOLA, or payoff instruction changes without a voice call-back to a known number, and tell clients in writing that you will never change wiring details by email.
- Review mailbox rules and forwarding on every account for auto-forwards or hidden rules, a common sign of email compromise.
- Write a one-page incident card: who leads, who calls your insurer, IT provider, and malpractice carrier, and how you notify clients and courts if systems are down.
Brotherly Technology helps law firms and professional offices across Rome, Northwest Georgia, Atlanta, Chattanooga, and our TN/AL/NY (Wallkill) footprint turn ransomware headlines into a short readiness review covering MFA, backups, vendor access, and payment-change controls. If you want a second set of eyes before the next claim lands, give us a call.
Sources:
- Ransomware.live: Rosenberg & Pittinsky / Global Secret Group. Discovered 2026-10-19 22:23 UTC; est. attack date 2026-10-19; claimed 430 GB; domain rpllplaw.com; claim-level only.
- Rosenberg & Pittinsky, LLP (rpllplaw.com). Context: general-practice firm founded 1998, Port Washington, NY; real estate, litigation, and business law. No incident acknowledgment cited here.