On January 29, 2024, Canadian insurance litigation firm Dutton Brock appeared on the leak site operated by the alphv ransomware group. The listing states that internal files were exfiltrated during a ransomware attack on the firm, which was founded in 1982 and handles cases involving appeals, class actions, commercial litigation, construction disputes, coverage questions, and cyber liability.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Watch Dutton Brock
Get alerted the next time Dutton Brock files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about Dutton Brock’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
Reported Details from the Listing
The alphv leak site entry, accessible via the .onion link mirrored on ransomware.live, states that attackers obtained internal files from Dutton Brock. The disclosure does not specify the volume of data taken, the exact types of documents involved, or the number of individuals whose information appears in the files. It simply states that data was exfiltrated and gives the firm a deadline to negotiate before samples or larger portions are published. No client lists, policy documents, or personal records are described in the public portion of the listing itself.
Why This Matters for You and Your Family
If you or anyone in your household has ever been represented by Dutton Brock, worked with one of their clients, or had personal information included in an insurance claim or litigation file handled by the firm, your details may now sit in a ransomware operator’s archive. Internal files from a litigation practice routinely contain names, addresses, dates of birth, Social Insurance Numbers, medical records, financial details, and correspondence that can be used for identity theft or fraud. Even though the exact scale remains unknown, the mere presence of a law firm on an active ransomware leak site means the clock is ticking for anyone whose records were stored on the compromised systems.
The Doxxing and Identity-Chain Risks
Ransomware groups rarely stop at posting generic “proof” files. Once internal documents surface, opportunistic criminals scrape names, emails, phone numbers, and addresses, then cross-reference them with other breaches. A single leaked insurance file can link your work email to a personal phone number, a child’s school records, or a spouse’s banking details. These connections form doxxing chains that lead to targeted phishing, SIM-swapping, or full identity takeover. Gaming accounts belonging to children are especially vulnerable because the same password or recovery email reused from a family member’s professional matter can hand over an entire digital life.