Cavanaugh, Biggs & Lemon PA, Attorneys at Law Listed by ALPHV Ransomware Group

On July 20, 2023, the law firm Cavanaugh, Biggs & Lemon PA appeared on the leak site of the Alphv ransomware group. The listing states that internal files were exfiltrated during a ransomware attack. The firm has not published a public breach notification detailing the number of people affected or the exact records involved.

Details from the Leak Site

The Alphv listing states that the Topeka-based law firm suffered a ransomware intrusion in which attackers copied internal files before encrypting systems. No specific volume of records is provided, and the disclosure does not list the categories of documents taken. The site presents samples of the allegedly stolen material and gives the firm a deadline to negotiate before full publication. Public records show Cavanaugh, Biggs & Lemon provides legal services in litigation, workers’ compensation, and business law, meaning client case files, contracts, insurance records, and employee information are likely among the data at risk.

Why This Matters for You and Your Family

If you or any member of your family has been represented by Cavanaugh, Biggs & Lemon, your personal information may now sit on a criminal server. Client names, addresses, dates of birth, Social Security numbers, medical details tied to workers’ compensation claims, and financial records are the kinds of information routinely stored in a law firm’s internal files. Exposure of this data increases the chance that identity thieves can open accounts in your name, file fraudulent tax returns, or target you with convincing spear-phishing emails that reference real case history. Even if you were not a direct client, employees of the firm and the businesses it represents—such as local clinics, insurers, and engineering companies—face the same risks.

Doxxing and Identity-Chain Risks

Ransomware operators rarely stop at one dataset. A single leaked email address or phone number can be chained with information from earlier breaches to build a complete profile. Attackers link your professional identity to personal accounts, family members’ records, and even children’s online gaming handles that share the same address or recovery email. Once the chain is mapped, extortion demands can follow, or the data can be sold to other criminals who specialize in long-term identity fraud. The Alphv listing adds another node to that chain for anyone connected to the firm.

Alphv Group’s Known Track Record

Public reporting attributes the Alphv operation, also known as BlackCat, to a rebrand of the DarkSide gang that conducted the Colonial Pipeline attack in 2021. The group reappeared in late 2022 using a ransomware-as-a-service model that lets affiliates handle intrusions while the core team manages encryption, data theft, and extortion. Notable prior victims include large corporations in healthcare, manufacturing, and professional services. Their typical playbook begins with compromised credentials or phishing, followed by rapid lateral movement, exfiltration of sensitive files, deployment of custom ransomware, and dual extortion: demanding payment to decrypt systems and a second sum to prevent data publication. Deadlines are strictly enforced, and partial leaks are often posted to pressure victims.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real-world identity, including any connection to the Cavanaugh, Biggs & Lemon breach.
• Rotate passwords used at the firm or any related vendor and enable 2FA through an authenticator app rather than text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure that touches you or your family is caught and acted on quickly.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often become entry points when credential leaks cascade into account takeovers.
• Let remediation specialists handle data-broker takedown requests and ongoing exposure cleanup on your behalf.

The incident is a reminder that even regional professional-service firms hold information that can fuel identity crimes for years. Starting with a clear picture of where your data surfaces and moving quickly to close those channels remains the most practical defense. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts at risk from cascading credential leaks.