Gress Clark Young & Schoepper Data Breach

On 2026-10-10, the ransomware group rhysida added Gress Clark Young & Schoepper to its dark web extortion site. This US-based professional services firm is now listed among rhysida’s victims, a group known for its consistent targeting of specific sectors. In the past 60 days, rhysida has claimed 25 victims, with a strong concentration in the Professional Services and Healthcare industries. These claims primarily involve victims located in the United States, Germany, and Lebanon. Professional services firms are frequently targeted by ransomware groups due to the sensitive client data they possess. Information such as financial statements, legal filings, and strategic plans can create significant client notification obligations and reputational damage if leaked. This potential for severe repercussions is a key leverage point that ransomware groups like rhysida exploit to drive extortion payments.

SOCRadar’s analysis of stealer-log data for Gress Clark Young & Schoepper yielded a result of “no_exposure_in_sample.” This indicates that no domain-linked credentials were found within the current dataset that was queried. However, this finding does not definitively confirm the absence of any compromise. The stealer-log query is limited in scope and may not capture credentials associated with partner or consultant aliases. Furthermore, data from phishing attacks, vulnerability exploitation, or credentials acquired through initial access brokers (IABs) would not surface in a stealer-log analysis. The absence of visible stealer-log records suggests that the initial access vector for any potential compromise may have been through alternative means, such as exploitation of VPN or email server vulnerabilities, or through a targeted spear-phishing campaign. Given rhysida’s consistent operational patterns and their focus on data sensitivity for extortion, a thorough forensic investigation is highly recommended. Organizations should review their security posture, including client notification procedures, regardless of the stealer-log findings. rhysida is noted for its consistent targeting of sectors where data sensitivity can be effectively leveraged for extortion. The null result from the stealer-log monitoring shifts the potential initial access scenario towards methods that do not typically leave such traces. This includes exploiting vulnerabilities in VPNs or email servers, or employing direct spear-phishing techniques. Therefore, continued monitoring of the dark web and stealer-log feeds, alongside proactive credential hygiene checks and reviewing access logs for remote access portals, remains crucial for Gress Clark Young & Schoepper.