[GENESIS] – Ransomware Victim: Kipp & Christian
NOTE: No files or stolen information are exfiltrated, downloaded, taken, hosted, seen, reposted, or disclosed by RedPacket Security. Any legal issues relating to the content should be directed at the attackers, not RedPacket Security. This blog is an editorial notice informing that a company has fallen victim to a ransomware attack. RedPacket Security is not affiliated with any ransomware threat actors or groups and will not host infringing content. The information on this page is automated and redacted whilst being scraped directly from the GENESIS Onion Dark Web Tor Blog page.
AI Generated Summary of the Ransomware Leak Page
On October 26, 2025, a leak page attributed to the Genesis ransomware group lists Kipp & Christian as a victim. The page frames the incident as a data-leak event rather than encryption. The body excerpt describes Kipp & Christian as a Salt Lake City, Utah-based law firm that handles complex litigation in areas such as insurance defense, personal injury, professional liability, products liability, and commercial litigation, and notes revenue of about $5 million. The page provides a single download link labeled “Download The List of Company Files” that points to a .RAR archive, implying the exfiltration of internal documents. There are no screenshots or images on the page. The excerpt also references the firm’s publicly available site in a defanged form: hxxps://www[.]kippandchristian[.]com.
According to the metadata, the post date is October 26, 2025; there is no explicit compromise date listed, so this is identified as the post date. The leak is attributed to the Genesis group and centers on a file described as “The List of Company Files,” with one download link and no media assets. This pattern aligns with ransomware data-leak extortion activity, where attackers threaten to disclose stolen data. The victim is a law firm in the United States; no ransom amount is shown in the available excerpt. No screenshots or images are present on the page, which narrows the public-facing content to the single download link for the company files. Based on the content available, the event appears to be a data leak rather than an encryption-only breach; further verification would be required to determine the scope of data exposure and any potential impact.
Support Our Work
A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.
If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.
