On December 22, 2022, the Iowa-based Dutton Law Firm appeared on the leak site operated by the Clop ransomware group. The listing states that internal files were exfiltrated during a ransomware attack on duttonfirm.com. The disclosure does not specify the number of people affected or list exact data types beyond claiming that sensitive internal documents were taken.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 582 companies.
See what is exposed about you — free scan →Not ready yet? Run a free breach check on this email
We’ll check it against 13.1B+ leaked records right now — no account needed. Continuous monitoring & alerts are part of Protection.
Details from the Leak Site
The Clop leak page for Dutton Firm indicates the law practice was hit by a ransomware operation and that attackers successfully removed files before encryption. No victim count is provided, and the listing does not detail the volume or specific categories of records. The notice follows the group’s standard format of naming the target, posting a sample of allegedly stolen material, and threatening further publication if demands are not met. Public mirrors of the onion site, such as those tracked on ransomware.live, preserve the original December 2022 entry.
Why This Matters for You and Your Family
When a law firm’s internal files are stolen, the exposure often includes documents containing names, addresses, dates of birth, Social Security numbers, medical details from personal-injury cases, financial records, and attorney-client correspondence. Even though the exact contents are not quantified in the disclosure, any of these elements can be used to open accounts in your name, file fraudulent tax returns, or impersonate you with insurance companies. If you or a family member worked with Dutton Law Firm for an injury claim, divorce matter, or estate issue around or before late 2022, your information may now sit in an attacker’s archive. The breach therefore creates long-term identity risk that does not expire when the leak site posting is removed.
Doxxing and Identity-Chain Implications
Stolen legal files frequently link email addresses, phone numbers, home addresses, and client names together. Attackers can combine this information with credential leaks from other breaches to map an entire household. A single exposed email can lead to gaming-account takeovers for children, because many family members reuse passwords or security questions derived from personal events handled by the law firm. Once an attacker controls a child’s gaming handle tied to the same address or phone number, further doxxing becomes trivial. Credential leaks like this one cascade into account takeovers and doxxing chains that stretch far beyond the original breach.