Federal authorities have charged at least 21 people in a civil enforcement action, and as many as 30 in parallel criminal indictments, for allegedly running an insider-trading ring that spent roughly a decade stealing deal secrets from global law firms. The scheme, according to the SEC and the U.S. Attorney’s Office for the District of Massachusetts, generated tens of millions of dollars in illicit profits by exploiting law-firm document management systems to obtain material nonpublic information about pending mergers and acquisitions. Named defendants include Nicolo Nourafchan and Robert Yadgarov, and the alleged trades touched companies such as iRobot and KnowBe4.
Why a decade of stolen law-firm secrets matters right now
The SEC filed its civil complaint as Nicolo Nourafchan, et al., No. 26-civ-12068, in the District of Massachusetts, catalogued under Litigation Release No. LR-26551. In that filing and in an accompanying enforcement announcement, the agency alleges that 21 individuals participated in a coordinated effort to trade on confidential deal information misappropriated from multiple international law firms. On the criminal side, the U.S. Attorney’s Office for the District of Massachusetts has said that 30 people are facing charges in the broader scheme, a number that exceeds the SEC’s civil roster. The gap between those two figures suggests that some participants face only criminal exposure, while others are defendants in both the civil and criminal tracks.
The ring’s alleged longevity, described by both agencies as spanning roughly ten years, points to a specific structural vulnerability: at least one person inside a law firm apparently maintained persistent access to internal networks and shared credentials or information with outside traders. That hypothesis is directly testable. If the sealed and unsealed indictments are matched against defendants’ employment histories and the client-matter lists referenced in court filings, investigators and the public can determine whether the same insider supplied access across the full timeline or whether the ring recruited fresh sources as employees changed jobs. The criminal indictment in USA v. Fejal et al., filed in the District of Massachusetts, alleges misuse of law-firm document management systems and describes overt acts that stretch across multiple years and multiple firms.
The case lands at a moment when law firms are already under pressure to harden their cybersecurity. Firms sit at the junction of sensitive corporate information, from draft merger agreements to board presentations and internal forecasts. Unlike public companies, they are often less regulated on the cybersecurity front, yet they hold data that can move markets instantly. The allegations in the Nourafchan matter crystallize a fear that has circulated in the industry for years: that someone with legitimate access to a firm’s systems could quietly siphon off deal intelligence for personal gain, without ever breaching a client’s own network.
If proven, the government’s narrative would show how traditional professional gatekeepers can become conduits for financial crime. It also underscores how long a determined group can operate when it leverages existing access rather than staging noisy external hacks. A decade-long operation implies that internal controls, logging, and anomaly detection either failed to flag suspicious file access or did not translate into actionable internal investigations.
Indictments, alleged kickbacks, and the companies caught in the middle
Two separate criminal indictments anchor the government’s case. The first, USA v. Fejal et al., lays out a deal-by-deal chronology of alleged trades and describes how defendants allegedly accessed confidential files stored on law-firm servers. According to the DOJ, the scheme involved kickbacks, meaning traders allegedly paid insiders for the stolen information rather than simply receiving tips from friends or family. That transactional structure distinguishes this case from many prior insider-trading prosecutions, where the government had to prove a personal benefit flowing from tipper to tippee. Here, prosecutors allege a direct cash-for-secrets arrangement, which, if established, would present a more straightforward theory of corrupt exchange.
The Fejal indictment reportedly describes how participants obtained lists of pending transactions, draft merger agreements, and internal correspondence, then placed trades ahead of public announcements. The alleged conduct spans multiple sectors, from technology to consumer products, reflecting the diverse client base of the law firms whose systems were targeted. By tying specific trades to specific document accesses, prosecutors are attempting to draw a tight causal line between the theft of information and the profits that followed.
The second indictment, USA v. Nourafchan et al., zeroes in on a subset of defendants and specific trades. According to the DOJ filing, the indictment references deals involving iRobot and KnowBe4, two companies whose acquisition announcements would have moved their stock prices sharply. The filing also includes excerpts of alleged communications, including encrypted messages, in which participants allegedly discussed timing trades around “when news was gonna be announced.” Those messages, if authenticated at trial, would directly address intent and coordination, two elements the government must prove to secure convictions.
For the companies whose stocks were traded, there is no allegation that they engaged in wrongdoing or failed to make required disclosures. Instead, they appear in the court papers as the unwitting backdrop to a scheme that exploited the professional intermediaries they hired. Still, the episode may prompt boards and executives to press their outside counsel about access controls, vendor risk management, and audit trails for highly sensitive deal work.
The SEC’s civil action describes the core mechanism as misappropriation of material nonpublic information from multiple global law firms. That framing invokes the misappropriation theory of insider trading, under which liability attaches not because the trader owed a duty to the company whose stock was traded, but because the information was stolen from the source that held it in confidence. Law firms occupy a unique position in M&A transactions: they hold deal terms, timing, and pricing details for clients on both sides, often weeks or months before any public announcement. By focusing on that role, the SEC is signaling that professional service providers remain squarely within its enforcement perimeter when their information is abused.
Gaps in the public record and what to watch next
Several significant questions remain open. No primary-source forensic report has been released detailing exactly how defendants allegedly penetrated or navigated law-firm document management systems. The indictments describe the conduct in narrative terms, but the technical exhibits, if they exist, have not appeared in the public docket. Without those details, it is difficult to assess whether the breach exploited weak access controls, shared credentials, or a more sophisticated intrusion. That distinction matters, because the compliance response for law firms will differ depending on whether the core failure was cultural, procedural, or technological.
The aggregate profit figure, described by the DOJ as “tens of millions” in illicit gains, also lacks a verified, itemized breakdown. No bank records or trading ledgers have been made public. Prosecutors may introduce that evidence at trial or in connection with asset-freezing motions, but for now the number rests on the government’s summary characterization. Market participants and compliance officers will be watching for more granular data, both to gauge the scale of the alleged misconduct and to refine their own surveillance models for suspicious trading.
The discrepancy between the SEC’s 21 defendants and the DOJ’s 30 charged individuals raises its own set of questions. Some of the additional nine people may be lower-level participants whom the SEC chose not to pursue civilly, or foreign-based actors whose assets and trading activity fall outside the agency’s practical reach. Others could be individuals whose alleged conduct is more squarely criminal than regulatory, making criminal charges the primary tool. Until the full set of criminal charging documents is public, observers can only infer the government’s allocation of resources from the numbers.
Another unresolved issue is the status of any cooperating witnesses. Large, long-running insider-trading cases often feature one or more participants who plead guilty early and agree to testify in exchange for reduced sentences. The current public filings do not spell out who, if anyone, has taken that step. If cooperation agreements emerge, they could fill in gaps about how the ring was organized, how proceeds were divided, and whether any additional professionals beyond the charged defendants were involved.
For law firms, corporate clients, and market regulators, the next phase of the case will be closely watched. Pretrial motions may test the admissibility of digital evidence, including server logs and encrypted chats. Parallel administrative proceedings could follow if the SEC seeks industry bars against any licensed professionals. And regardless of the ultimate verdicts, the allegations are likely to accelerate ongoing efforts to treat law-firm cybersecurity as a core component of market integrity, not just an internal IT concern.
David M. Keller is a finance writer based in Columbus, Ohio, covering personal finance and consumer-focused economic topics. He earned his degree in journalism from Ohio University and began his career reporting on local business and economic trends for a regional media outlet. Since then, he has contributed to a variety of online publications, focusing on clear, practical coverage of topics such as cost of living, debt, and everyday financial decision-making.
