Wolf Haldenstein Adler Freeman & Herz LLP
bd_8d1aecbab7866ea5 · schema v1 · pii pii-v1
Threat-actor claim — not a regulatory filing
This row is a claim by the ransomware group Black Basta on its public extortion blog. It has not been validated by the victim or any regulator. Treat attribution and counts as the threat actor's assertion until a regulatory filing or victim disclosure corroborates them.
Source: Ransomware.live
Post text · scraped from the leak site
Wolf Haldenstein Adler Freeman & Herz LLP has decades of experience in complex litigation, with an emphasis on securities and shareholder derivative litigation, antitrust litigation, copyright litigation, business litigation, and consumer protection. The Firm has recovered more than $9 billion for its clients, including defrauded shareholders and investors, antitrust victims, victims of copyright infringement, and injured consumers. Wolf Haldenstein has earned global acclaim for its many groundbreaking achievements.SITE: www.whafh.com Address 270 Madison Avenue New York, New York 10016 UNITED STATES (212) 545-4600Symphony Towers 750 B Street, Suite 1820 San Diego, California 92101 UNITED STATES (619) 239-4599111 West Jackson, Suite 1700 Chicago, IL 60604 UNITED STATES (312) 984-00001008 17th Ave South Nashville, TN 37212 UNITED STATES (615) 270-8111FULL DATA SIZE: 452gb 1. I-9 forms 2. ConfidentialityNETWORK: WHAFHGROUP-------------------------DOMAIN ADMINS------------------------- admin Administrator Avada citrix cyberdocs dbagent discovery dm docs eqt_controller fusion gateway gjata gwweb hal2000 ldap legalkey mail mann monitor newwinny newwinsd NYDC2DHCP scheduler summation2 whafhapps whafhch whafhny whafhsd whafhsql whafhweb wolf1WHAFHGROUP\Administrator !w0lf1888!son-------------------------DC------------------------- whafhny.whafh.com 10.1.3.2 Windows Server 2008 R2 Standard WHAFHSD.whafh.com 10.3.1.2 Windows Server 2012 R2 Standard NYDC1.whafh.com 10.1.3.3 Windows Server 2008 R2 Standard SDDC1.whafh.com 10.3.1.2 Windows Server 2012 R2 Standard-------------------------SERVERS------------------------- Tabsny.whafh.com Windows Server 2019 Standard WIN-19.whafh.com Windows Server 2019 Standard tabs.whafh.com 10.1.3.4 Windows Server 2019 Standard CTX4.whafh.com 10.1.3.20 Windows Server 2012 R2 Standard WStorefront.whafh.com 10.1.3.69 Windows Server 2012 R2 Standard
J jump to incidentP pin to compareR raw source
Incident timeline — mostly unverified
? — ?
Breach window unknown
Dec 22, 2023
Claim posted
—
Corroborated · see linked filings
This record's own dates cannot anchor compliance clocks; see the linked filings.
Claim → filing
—
Compliance clock
Not assessable
Linked disclosures
Why this link?Regulatory filings (10) · sorted by filing gap
- New Hampshire State AGbd_01c8c467936f5ef02025-01-14 · +388dVerified by operator
- Maine State AGbd_59773b3aabb12e552025-01-15 · +389dVerified
- California State AGbd_d2bd2e440c25b7392025-01-15 · +389dVerified by operator
- Washington State AGbd_8fc1c900a335fed52025-01-16 · +390dVerified by operator
Show 6 more filings ↓Show fewer ↑up to 691d gap
- Massachusetts State AGbd_8552ef9d273399f82025-01-17 · +391dVerified by operator
- South Carolina State AGbd_9b1cd8fcc3d360312025-01-17 · +391dVerified by operator
- Iowa State AGbd_f6dabcb4a2c109fc2025-01-17 · +391dVerified by operator
- Rhode Island State AGbd_3e9cc9ff1838a31e2025-01-28 · +402dVerified
- Maryland State AGbd_747af5a683f6a74f2025-11-13 · +691dVerified by operator
- Maryland State AGbd_96d242fcec7fed342025-11-13 · +691dVerified by operator
Showing first 10 of 15 linked disclosures.
Filing propagation · 10 filings · 9 states
View merged incident ↗Pattern: first filing Jan 14 (NH), last Nov 13 (MD) — a 303-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?
Cascade drawn from the first 10 linked disclosures of 15 — the full spread may be wider.
Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.
Source ceiling
- actor name
- victim claim
- ransom/leak status
- discovery date
- materiality
- notification
- affected count
- confirmed data types
- compliance clock
The ✕ fields stay blank until a regulatory filing or victim disclosure lands.