GLOBALMalwareFinancial ServicesFinanceRansomwareSilentransomgroupRansom DemandedActor NamedMedium

Liberty Tax

bd_3f8087e96238c6e6 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Apr 8, 2025

To disclose

—

Affected

Not disclosed

Linked

3 filings

Confidence

50%

Full breach record for Liberty Tax →3 incidents on file

Threat-actor claim — not a regulatory filing

This row is a claim by the ransomware group Silentransomgroup on its public extortion blog. It has not been validated by the victim or any regulator. Treat attribution and counts as the threat actor's assertion until a regulatory filing or victim disclosure corroborates them.

Group activity: Financial ServicesDiscovered: 2025-05-06

View aggregator listing on ransomware.live View merged incident timeline

Source: Ransomware.live

Post text · scraped from the leak site

Headquartered Virginia Beach, Virginia, Liberty Tax is a full service tax preparations and refund comp...

J jump to incidentP pin to compareR raw source

Incident timeline — mostly unverified

? — ?

Breach window unknown

Apr 8, 2025

Claim posted

—

Corroborated · see linked filings

Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.

Claim → filing

—

Compliance clock

Not assessable

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitesilentransomgroupbd_5cbab934d6bce02d2024-12-13 · +116dVerified by operator

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_c1ea041fa0261d0b2025-05-30 · +52dVerified by operator

Name: SilentRansomGroup
norm: silentransomgroup

Name: Liberty Tax
norm: liberty tax
Domain: libertytax.com
Industry: Financial Servicesllm

Attack vector: Ransomware· silentransomgroup
Threat actor: SilentransomgroupExternalFinancial

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.
Confidence context: Single unverified source — the attacker's own description. When a regulatory filing corroborates the claim, it appears in the linked-filings card.

Filing propagation · 2 filings

View merged incident ↗

Leak SiteApr 8 · first · this page

Massachusetts State AG+52d

Pattern: first filing Apr 8, last May 30 (MA) — a 52-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claimThis record

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filing

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source ceiling

actor name
victim claim
ransom/leak status
discovery date
materiality
notification
affected count
confirmed data types
compliance clock

The ✕ fields stay blank until a regulatory filing or victim disclosure lands.

About this groupFirst seen 2022-06-07

silentransomgroup

According to ransomware.live, a former Conti team

165 tracked hereFull profile →

Source URL: https://www.ransomware.live/
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 8, 2025
Raw hash: c15d592ef6c9f133b4d7958c183729b68ba573768e94db3ad5ccfa7144c5c057

Linked disclosures

Ransomware claims (1)

Regulatory filings (1) · sorted by filing gap

Reporting entitySilentRansomGroup

Victim entityLiberty Tax

What this source establishesRansomware

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.ransomware.live