Doak Shirreff Lawyers Listed by direwolf Ransomware Group

On July 8, 2025, Canadian law firm Doak Shirreff appeared on the leak site of the direwolf ransomware group. The firm, based in Kelowna, British Columbia, is claimed to have had internal files exfiltrated during a ransomware attack. While the exact number of people whose information may have been exposed remains unknown, anyone who has worked with or been represented by the firm could be affected.

Reported Details of the Breach

Public reporting indicates that direwolf listed Doak Shirreff on its data-leak portal, claiming to have stolen internal documents. The firm provides full-service legal representation, which means client records, contracts, correspondence, and personal identifiers were likely among the stolen material. No precise volume of records or specific data types has been publicly detailed beyond the broad description of internal files.

The listing appeared on the group’s onion site, as tracked by ransomware.live. At the time of publication, it is unclear whether direwolf has set a public extortion deadline or begun dumping additional samples.

Why This Matters for You and Your Family

When a law firm is breached, the information exposed often includes names, addresses, dates of birth, Social Insurance Numbers, financial details, and family records. If your lawyer used Doak Shirreff for real estate closings, estate planning, divorce, or any civil matter, those documents may now sit on a criminal server. One leaked file can contain enough data to open accounts in your name or impersonate you to government agencies.

Children’s information is frequently included in family-law or guardianship files. A single breach like this can therefore place every member of a household at risk, not just the primary client.

The Doxxing and Identity-Chain Risk

Ransomware operators rarely stop at posting generic samples. They map relationships between email addresses, phone numbers, usernames, and family members to create saleable identity packages. A credential or document from this claimed breach can link to your online accounts, including gaming logins used by you or your children. Those gaming accounts often share the same passwords or recovery emails, turning a legal-matter breach into a chain of takeovers that ends in doxxing, harassment, or financial fraud.

Credential leaks like this one cascade into account takeovers precisely because people reuse passwords across work, legal services, and personal platforms.

Direwolf’s Known Track Record

Public reporting attributes the direwolf ransomware group with emerging in late 2024. The group has targeted mid-sized organizations across North America and Europe, focusing on legal practices, manufacturers, and healthcare providers. Its typical playbook involves initial access through phishing or exploited remote desktop services, followed by exfiltration of sensitive files before encryption. Direwolf then demands payment to prevent publication, using its leak site to pressure victims with partial data samples. Exact success rates and prior victim counts are difficult to verify, but the group maintains an active presence on dark-web leak portals.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity, then use the cleanup to remove what you can.
• Rotate any password you ever used at Doak Shirreff or associated services, and switch on 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure is caught and acted on within hours.
• Cover the household with DoxxScan family protection that includes dependents and children’s gaming accounts, which often chain back to the same addresses and recovery details.
• Let remediation specialists handle ongoing takedown requests across data brokers and leak sites on your behalf.

The pace of ransomware leaks shows no sign of slowing. Protecting your family requires more than changing a password; it demands visibility into how your information travels and decisive action when it surfaces. DoxxScan by GalaxyWarden delivers that visibility through continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage that explicitly includes children’s gaming accounts. Starting early limits the damage from incidents like the Doak Shirreff breach before criminals can build the next link in the chain.