Severity moderate: The group's internal ledger lists 50 organisations, 27 marked as paid, a scope spanning many third parties.
Happened 2026-02-06 · Earliest source we hold 2026-10-28, 264 days later
GuidePoint Security analysed leaked Silent Ransom Group messages and found eight containing signs of ChatGPT-copied content, used for researching settlements and fines, building information, recruitment adverts and US military installations.
Risk grouping: Not yet classified
No source we hold states: who caused it, intended or not, before or after release, the ai's part.
The story
1 · What it was doingThe Silent Ransom Group, a cybercrime gang, allegedly used ChatGPT to research victims' settlements and fines, building operations, recruitment adverts and US military installations, supporting human operators rather than acting autonomously.
2 · What went wrongThe group used ChatGPT research to support extortion of law firms, impersonating IT staff to gain remote access and copying confidential data, though the chats do not show ChatGPT itself executing attacks.
3 · What it reached or didThe group targeted US law firms, copying confidential information and threatening to publish or sell files, with an internal ledger listing 50 organisations and claimed payments of $206.95 million.
4 · How it was caughtGuidePoint Security researchers found the ChatGPT use by analysing thousands of leaked Silent Ransom Group messages; the FBI separately documented the group's tactics.
5 · What was doneThe FBI recommends verifying IT support identities, training staff on phishing, restricting sensitive system access and controlling remote-access software and external storage devices.
No source states: when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off.
D inferred by us from the described behaviour, reason shown
What it was for
Researching historical settlements and fines, gathering information about buildings, drafting recruitment adverts, and researching US military installations and defence manufacturers.
C one secondary source states it
What happened
When it happened
2026-02-06
C one secondary source states it
Earliest source we hold
2026-10-28
A the date the source itself carries
Who caught it
an independent researcher or journalist
D inferred by us from the described behaviour, reason shown
Themes
extortion, ransomware group abuse, leaked chats
D inferred by us from the described behaviour, reason shown
Who was responsible
an outside party
D inferred by us from the described behaviour, reason shown
Who caused it
an outside attacker
C one secondary source states it
What went wrong
produced harmful content
D inferred by us from the described behaviour, reason shown
AI agent
no AI agent acted
C one secondary source states it
Impact
Severity
moderate
D inferred by us from the described behaviour, reason shown
Kind of harm
money, privacy
C one secondary source states it
Who was affected
50 organisations listed in an internal ledger between February and September 2026; US law firms targeted by the group
C one secondary source states it
Why this severity
The group's internal ledger lists 50 organisations, 27 marked as paid, a scope spanning many third parties.
D inferred by us from the described behaviour, reason shown
Context
Industry
Legal services
C one secondary source states it
Country
United States
C one secondary source states it
LR-2026-0249 · version 2 · published 2026-10-28 after automatic checks; not yet checked field by field by a person · changes to this case · JSON