ehdd.com Listed by incransom Ransomware Group

On February 20, 2025, architecture firm EHDD appeared on the leak site of the incransom ransomware group. The firm, founded in 1946 and headquartered in San Francisco, is claimed to have had internal files exfiltrated after a ransomware attack. While the exact number of people whose information may have been exposed remains unknown, anyone whose personal or professional data passed through EHDD’s systems could be affected.

What's Publicly Reported from Reporting

Public reporting indicates that EHDD’s internal files were taken and later published on the incransom leak site. The firm specializes in designing aquariums, museums, science centers, educational facilities, corporate offices, mixed-use developments, and government buildings. It has earned recognition as a Top 10 AIA COTE honoree and is known for sustainable, high-performance design. Available reporting describes the incident as a classic ransomware operation in which attackers gained access, encrypted systems, exfiltrated data, and then threatened to publish it unless a ransom was paid. No confirmed total of records or specific categories of personal information have been publicly detailed beyond the broad description of internal files.

Why This Matters for You and Your Family

When an architecture or design firm like EHDD is breached, the exposed files often contain contracts, client contact lists, employee records, vendor agreements, and project documentation. Names, addresses, phone numbers, email addresses, and sometimes Social Security numbers or dates of birth can appear in these documents. If you or your family have ever worked with EHDD, lived in a building it designed, or had your information shared with it through a school, museum, government project, or corporate client, your details may now sit in a ransomware data dump. Once that information is public, it rarely disappears. It circulates on dark-web marketplaces and can be used for identity theft, phishing, or harassment for years.

The Doxxing and Identity-Chain Implications

Ransomware leaks rarely stop at one company. A single exposed email or phone number can link your professional life to your personal accounts, your children’s school records, or even their gaming usernames. Attackers and opportunistic criminals follow these chains to build full profiles. Credential leaks like this one frequently cascade into account takeovers on email, banking, or social media. Gaming accounts belonging to you or your children are especially vulnerable because kids often reuse passwords or email addresses tied to family domains. The result is doxxing that can expose home addresses, family relationships, and daily routines.

Incransom’s Publicly Known Track Record

Public reporting attributes incransom with emerging in late 2023 or early 2024 as a ransomware-as-a-service operation. The group has targeted organizations across multiple sectors, publishing victim data on its onion site when ransoms go unpaid. Its typical playbook involves initial access through phishing or exploited remote desktop protocols, followed by lateral movement inside networks, data exfiltration, encryption, and then dual extortion: demanding payment to decrypt files and to prevent publication. Notable prior victims have included mid-sized businesses and professional services firms, though exact details vary by leak-site postings. Readers can follow public trackers for the latest incransom activity.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup to remove what you can.
• Rotate any password you used at EHDD or any related vendor account, and switch on 2FA through an authenticator app rather than text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure is caught in hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts that often chain back to the same addresses and emails.
• Let remediation specialists handle takedown requests across data brokers and leak sites on your behalf while you focus on securing your own accounts.

The EHDD breach is a reminder that professional services firms hold far more personal information than most people realize. Taking concrete steps now can limit how far this leak travels. DoxxScan by GalaxyWarden offers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Starting your DoxxScan trial gives you and your family a practical way to reduce exposure before the next opportunistic criminal connects the dots.