Goldenbear.com & mjhallandcompany.com Listed by moneymessage Ransomware Group

On April 02, 2023, insurance providers Goldenbear.com and mjhallandcompany.com were listed on the leak site of the moneymessage ransomware group. The primary disclosure on the group’s onion site states that internal files were exfiltrated during a ransomware attack on both companies, which provide commercial property, casualty, professional liability, residential earthquake, and general business insurance across California and other markets.

Details from the Leak-Site Listing

The moneymessage leak site explicitly names both Golden Bear and M.J. Hall and Company, listing their websites, short corporate descriptions, revenue figures, and employee counts. It states that data was taken in a ransomware incident but does not specify the exact volume of records or the full list of file types exposed. The disclosure indicates the companies are now subject to the group’s standard extortion timeline, after which samples or larger portions of the stolen internal files are typically published if demands are not met. No customer record count is provided in the listing, leaving the precise scale of personal data at risk unknown from the primary source.

Why This Matters for You and Your Family

If you hold any policy issued through Golden Bear or M.J. Hall and Company, your personal information may sit inside the internal files now controlled by moneymessage actors. Insurance records routinely contain names, addresses, dates of birth, Social Security numbers, policy details, claims histories, and banking information used for premium payments. Exposure of this data increases the chance that fraudsters can file false claims, open accounts in your name, or combine it with other leaks to build a complete profile. Your family members listed as additional insureds or drivers face the same risk even if they never interacted directly with the insurer.

Doxxing and Identity-Chain Risks

Insurance data leaks create long identity chains. A single exposed email or phone number from these files can be cross-referenced with gaming accounts, social-media handles, and breach repositories to map your entire digital footprint. Threat actors routinely use stolen policy documents to impersonate victims when contacting banks or government agencies. Children’s records included on family policies are especially vulnerable because minors rarely monitor their own credit or online presence. Credential leaks of this nature frequently cascade into gaming-account takeovers, where stolen logins grant access to linked payment methods and private messages that further expand the doxxing surface.

Moneymessage Group Track Record

Public reporting attributes moneymessage with emerging in late 2022 as a ransomware and extortion operation. The group is known for targeting small and mid-sized businesses, including insurers and professional-service firms. Their typical playbook involves initial access through phishing or exploited remote-desktop services, followed by exfiltration of sensitive internal files before encryption. They then list victims on their leak site with corporate details and pressure payment through both data-publication threats and direct contact. Prior victims listed by the group have included healthcare providers and manufacturing companies, though exact success rates remain unclear from open sources.

What to do

• Rotate any password you have used at goldenbear.com or mjhallandcompany.com and enable 2FA with an authenticator app everywhere that password was reused.
• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity with cleanup handled by the service.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your data is flagged within hours rather than months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts that often chain back to the same leaked address or email.
• Let remediation specialists manage takedown requests for any exposed personal documents or broker listings that surface from this incident.

The incident underscores that even regional insurers can become high-value targets, turning routine policies into vectors for long-term identity compromise. Start your DoxxScan trial today and maintain continuous monitoring and specialist remediation so that neither you nor your family are left exposed when the next leak appears. DoxxScan’s AI-powered identity-chain mapping and hands-on assistance provide the practical defense needed against cascading breaches like this one.