Rella Associates Listed by insomnia Ransomware Group

On December 4, 2025, Rella Associates, P.C., a Sleepy Hollow, New York law firm specializing in workers’ compensation, Social Security Disability, and NYCERS claims, appeared on the leak site of the insomnia ransomware group. The firm’s internal files were allegedly exfiltrated during a ransomware attack, exposing sensitive client information that could affect anyone who has ever used their services for job-related injury or illness claims.

Reported Details of the Breach

Public reporting indicates that insomnia listed Rella Associates on its dark-web leak portal, confirming successful data exfiltration. The firm, led by attorneys Gerarda Rella and Michael Catallo, handles highly personal legal matters involving medical records, financial details, Social Security numbers, and employment histories. While the exact number of affected individuals remains unknown, the nature of a law firm’s case files means client names, addresses, dates of birth, medical diagnoses, benefit amounts, and correspondence are likely included in the stolen material. No evidence has surfaced that the data has been sold or publicly released beyond the leak site listing itself.

Why This Matters for You and Your Family

If you or anyone in your household has ever hired Rella Associates for a workers’ compensation claim, disability application, or related legal help, your private information is now in the hands of criminals. Medical records and Social Security numbers are especially dangerous because they allow identity thieves to file fraudulent tax returns, open credit accounts, or claim government benefits in your name. Even if you were not the primary client, family members listed on joint claims or shared addresses can be pulled into the same pool of exposed data. Children’s information sometimes appears in parental disability or injury filings, creating long-term risks that many people overlook.

The Doxxing and Identity-Chain Risks

Ransomware groups rarely stop at one leak. Once client data surfaces, it can be cross-referenced with usernames, email addresses, or phone numbers found in the files. This creates an identity chain that links your real name and address to online handles used for banking, shopping, or gaming. Credential leaks of this kind frequently cascade into account takeovers. Gaming accounts belonging to you or your children are particularly vulnerable because kids often reuse simple passwords or email addresses tied to family records. A single breach can therefore lead to doxxing, harassment, or further extortion attempts months later.

Insomnia Ransomware Group’s Track Record

Public reporting attributes the insomnia ransomware group with emerging in 2024 and focusing on smaller to mid-sized organizations. The group’s typical playbook involves initial access through phishing or exploited remote desktop protocols, followed by data exfiltration before deploying ransomware. They then demand payment to prevent publication of stolen files. Notable prior victims have included various professional service firms and healthcare-related entities, though exact details vary across incident reports. Their extortion style relies on pressure through public leak-site postings and occasional direct contact with victims or their clients.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real identity so you can see exactly what chains back to the Rella Associates breach.
• Rotate any password you ever used at Rella Associates or related legal portals anywhere it has been reused, and switch to 2FA through an authenticator app rather than text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information appears it is caught and addressed within hours instead of months.
• Cover your entire household with DoxxScan family protection that includes dependents and children’s gaming accounts, which often become entry points when credential leaks like this one spread.
• Let DoxxScan remediation specialists handle takedown requests and data-broker removals for you while you focus on securing accounts and monitoring statements.

The Rella Associates incident shows how quickly professional-service data breaches can reach ordinary families who simply sought help with an injury claim. Taking concrete steps now limits how far criminals can travel down the identity chain created by this leak. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that explicitly protects children’s gaming accounts from the kind of cascading takeovers this breach can trigger.