A leak-site listing tied to a professional accounting firm is not proof of breach, but it is a reminder that ransomware crews use public claims as pressure, noise, and sometimes misdirection.