Glovers Solicitors LLP Listed by ALPHV Ransomware Group

On February 23, 2023, Glovers Solicitors LLP appeared on the leak site operated by the alphv ransomware group. The listing states that internal files were exfiltrated during a ransomware attack on the London-based property law firm. The disclosure does not quantify how many individuals or client records are affected, nor does it list the specific types of documents taken.

Primary Disclosure Details

The alphv leak site entry, still accessible via the .onion link mirrored on ransomware.live, states that Glovers Solicitors suffered a ransomware incident in which attackers successfully exfiltrated internal files. The notification provides no breakdown of the data categories, no client list, and no exact volume of records. It simply states that material was stolen and gives the firm a deadline to negotiate before further publication. This matches the standard format alphv uses for victims who have not yet paid or engaged with the group.

Glovers, originally founded in 1932 as Glover & Co in Mayfair and now based in Covent Garden, specialises in property law. Its clients include individuals and businesses whose conveyancing files, identity documents, financial details, and correspondence would typically reside in such internal systems.

Why This Matters for You and Your Family

If you or any member of your family has ever used Glovers Solicitors for house purchases, sales, lease extensions, or property disputes, your personal data may now sit in an attacker-controlled archive. Property transactions routinely involve passports, driving licences, bank statements, tax records, and proof of address. When these documents leave a law firm’s controlled environment, the risk extends far beyond simple identity theft. Fraudsters can use them to impersonate you with banks, conveyancers, or government agencies. Your family members listed on the same transactions are equally exposed.

Doxxing and Identity-Chain Risks

Stolen legal files rarely exist in isolation. A single conveyancing folder often links your full name, current and previous addresses, phone numbers, email accounts, date of birth, and national insurance number. Attackers routinely combine this information with credential leaks from other breaches to build detailed identity chains. Once your email and password from this incident are matched to accounts on banking, email, or social media platforms, the compromise can cascade quickly. Public reporting shows that alphv and similar groups frequently auction or publish such folders in batches, allowing multiple criminals to exploit the same victim over time.

Children’s details sometimes appear in family trusts or joint property purchases. Gaming accounts tied to a parent’s email can become entry points for further harassment or account takeovers when those credentials surface. The speed at which stolen legal data travels across dark-web markets makes early detection essential.

Alphv Group Track Record

Public reporting attributes the alphv ransomware operation, also known as BlackCat, to a Russian-speaking criminal collective that emerged in late 2021. The group is known for targeting mid-sized professional services firms, including law practices and consultancies. Their typical playbook begins with initial access gained through compromised remote desktop credentials or phishing, followed by rapid lateral movement, data exfiltration, and deployment of custom ransomware. After encryption, they pressure victims through a dual-extortion model: threatening both data publication on their leak site and contact with the victim’s clients or regulators. Alphv has repeatedly demonstrated willingness to publish sensitive folders when negotiations stall, and their leak site remains one of the more active ransomware portals.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity drawn from this and connected breaches.
• Rotate any password you ever used at Glovers Solicitors or related property portals, then enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces within hours instead of months.
• Cover the household with DoxxScan family protection that includes dependents and children’s gaming accounts which often chain back to the same compromised emails or addresses.
• Let remediation specialists handle data-broker takedown requests and ongoing exposure cleanup on your behalf.

The incident underscores how quickly a single professional services breach can ripple into long-term identity risk for ordinary families. Acting promptly limits what criminals can build from the stolen files. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with household coverage that explicitly protects children’s gaming accounts from cascading takeovers.