Brown & Brown PC Listed by dragonforce Ransomware Group

On June 23, 2025, the ransomware group DragonForce added Brown & Brown, P.C. to its leak site and began publishing what it claims are internal files stolen from the Virginia-based law firm, including records that contain data on several thousand customers.

Reported Details of the Breach

Public reporting indicates the firm was listed on the DragonForce leak site with a post dated June 23, 2025. The group states it exfiltrated internal files during a ransomware attack and has begun releasing samples. Available reporting describes the exposed material as including customer data belonging to several thousand individuals. Exact victim counts, the full scope of systems compromised, and the precise data fields involved have not been independently verified by the firm or third parties at the time of writing. The leak site is hosted on the dark web, a common tactic used by ransomware operators to pressure victims into payment.

Why This Matters for You and Your Family

When a law firm that handles personal legal matters suffers a breach, the information exposed often includes names, addresses, dates of birth, Social Security numbers, financial details, and case files that can reveal sensitive family circumstances. Several thousand customers are potentially affected. If your data was among the records taken, criminals can use it to file fraudulent tax returns, open accounts in your name, or sell it on underground markets. For families, this risk extends beyond the primary account holder to spouses, children, and anyone whose information was stored in the same client files.

The Doxxing and Identity-Chain Risks

Stolen legal documents frequently contain enough personal details to link online handles, email addresses, phone numbers, and real-world identities. Once criminals establish these connections, they can launch doxxing campaigns, targeted phishing, or SIM-swapping attacks. Credential leaks of this nature often cascade into gaming account takeovers, especially for children whose usernames and passwords may be reused across family devices or stored in the same compromised systems. A single breach can therefore create long-term exposure that reaches far beyond the original law-firm files.

DragonForce’s Known Track Record

Public reporting attributes DragonForce with emerging in late 2023 as a ransomware-as-a-service operation. The group has claimed responsibility for attacks on organizations across multiple sectors, typically gaining initial access through phishing, remote desktop protocol exploits, or stolen credentials. After exfiltrating data, DragonForce follows a double-extortion playbook: it encrypts victim systems and threatens to publish stolen files on its leak site if ransom demands are not met. Notable prior victims include companies in healthcare, manufacturing, and professional services, according to trackers that monitor ransomware activity.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real identity so you can see exactly what chains back to the Brown & Brown breach.
• Rotate any password you used at the law firm anywhere else it is reused, and switch on two-factor authentication through an authenticator app rather than text messages.
• Enable continuous DoxxScan monitoring across 13.1 billion+ breach records and more than 100 platforms so the next time your information appears it is caught within hours instead of months.
• Cover the entire household with DoxxScan family protection, which includes dependents and children’s gaming accounts that often become targets when credential leaks create doxxing chains.
• Let remediation specialists handle the time-consuming work of sending takedown requests to data brokers and monitoring sites selling your information.

The incident shows how quickly a single professional services breach can expose ordinary families to identity theft and harassment. Taking concrete steps now limits the damage and reduces the chance that today’s leaked records become tomorrow’s fraudulent accounts or doxxing campaign. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage that explicitly protects children’s gaming accounts when credential leaks like this one spread.