Centennial Law Group LLP Listed by medusa Ransomware Group

On March 03, 2024, Centennial Law Group LLP appeared on the Medusa ransomware group’s leak site. The Canadian law firm, which serves private and corporate clients from its Hamilton, Ontario office, is the latest victim publicly listed after refusing or failing to meet the attackers’ demands. Anyone whose legal files, contracts, or personal information passed through the firm may now face heightened exposure.

Details from the Medusa Listing

The Medusa leak site states that internal files were exfiltrated during a ransomware attack on Centennial Law Group LLP. The listing does not quantify how many records were taken, name specific document types, or disclose the ransom amount demanded. It simply states that data was stolen and is now published because the firm did not pay. The disclosure also notes the firm’s address at 25 Main St W Ste 1702, Hamilton, Ontario, and its roughly 17 employees, details that help attackers add pressure through public shaming.

Internal files exfiltrated is the only description of the compromised material provided. No client list, no volume of records, and no sample documents are detailed on the initial listing page itself, though Medusa typically releases proof packets once a victim is fully published.

Why This Matters for You and Your Family

If you or any member of your family retained Centennial Law Group for estate planning, real-estate closings, divorce, corporate formation, or any other legal matter, your documents may now sit on a dark-web leak site. Law firms hold the most sensitive records many people ever create: Social Insurance Numbers, bank account details, family medical history, child custody agreements, and full home addresses. Once these files leave the firm’s control, they become permanent ammunition for identity thieves, stalkers, or fraudsters who buy the data on underground forums.

March 03, 2024 marks the moment the exposure became public. From that date forward, the clock starts for opportunistic criminals who scan fresh ransomware leaks for fresh identities. Ordinary people rarely realize their lawyer’s breach affects them until fraudulent loans appear or unexpected mail arrives from unfamiliar debt collectors.

Doxxing and Identity-Chain Risks

Legal documents rarely contain only one piece of information. A single client file can link your full name, date of birth, spouse’s details, children’s names, home address, phone numbers, email accounts, and sometimes even login credentials for financial portals. Attackers chain these fragments together: an email from one document is tested against breached passwords from earlier leaks, a phone number is sold to data brokers, and an address is used to locate you on people-search sites. The result is a complete identity profile that can fuel account takeovers, SIM-swapping, or physical intimidation.

Credential leaks like this one frequently cascade into gaming accounts. Children’s usernames, shared family emails, or reused passwords from a parent’s legal correspondence can hand over Roblox, Fortnite, or Steam accounts in minutes. Once those gaming profiles are hijacked, attackers extract further personal details or use them as stepping stones to harass the entire household.

Medusa’s Known Track Record

Public reporting attributes Medusa’s first major campaigns to late 2021. The group operates a double-extortion model: it encrypts victim systems and simultaneously exfiltrates data, then threatens both restoration failure and public release. Notable prior victims include manufacturing firms, healthcare providers, and other professional-services organizations across North America and Europe. Medusa typically gains initial access through phishing, remote-desktop protocol brute-force, or exploited vulnerabilities in unpatched software. After exfiltration, the group posts a teaser on its leak site and gives the victim a short deadline—often two to four weeks—before full data publication. The playbook relies on reputational damage to pressure small and mid-size businesses that lack dedicated incident-response teams.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity so you can see exactly what Centennial-related data may already be circulating.
• Rotate any password you ever used at Centennial Law Group anywhere it is reused, and switch on 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure that touches you or your family is caught in hours, not months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same breached emails or addresses.
• Let remediation specialists handle takedown requests across data brokers and leak forums for you while you focus on securing day-to-day accounts.

The Medusa listing of Centennial Law Group LLP is a reminder that professional-service providers remain high-value targets whose breaches directly expose ordinary clients. Acting quickly on the exposure can limit how far the stolen data travels. DoxxScan’s continuous monitoring, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage—including children’s gaming accounts—gives families a practical way to track and reduce these risks before thieves turn leaked legal files into long-term identity theft. Start your DoxxScan trial today and treat this incident as the warning it is.