Halliday Watkins Mann Listed by The Gentlemen Ransomware Group

On August 07, 2026, the ransomware group known as The Gentlemen listed Halliday, Watkins & Mann, P.C. (HWM), a Salt Lake City-based law firm, on its public leak site. The firm, which specializes in creditor remedies for the mortgage banking industry, has not publicly confirmed the incident as of this writing, making the claim unverified by the organization itself.

Details from the Leak-Site Listing

The Gentlemen’s leak-site entry, hosted on infrastructure tracked via RansomLook, names hwmlawfirm.com and includes a reference to the firm’s ZoomInfo profile. The listing does not specify the volume of records affected, the exact data types allegedly taken, or any ransom demand amount. According to the group’s posting, they claim to have obtained files from the firm’s systems and threaten to publish them if their demands are not met. Because the primary disclosure comes solely from the threat actor’s own leak site rather than a company notification or regulator filing, this remains an unconfirmed claim. The firm has issued no public statement acknowledging a breach, data theft, or extortion attempt.

Why This Matters for You and Your Family

If you have ever been a client of Halliday, Watkins & Mann, worked with them on a foreclosure, bankruptcy, eviction, or title matter, or had your information shared with them by a mortgage lender, your personal data may be at risk. Law firms handling creditor remedies routinely possess highly sensitive documents: Social Security numbers, financial account details, loan histories, property addresses, bankruptcy filings, and payment records. Even though the exact contents of the alleged theft remain unknown, the nature of the firm’s work means any exposed data would likely include information that can be used for identity theft, loan fraud, or targeted financial scams against you or your household.

Doxxing and Identity-Chain Risks

A leak from a specialized law firm like HWM creates extended doxxing chains. Client files often link names, current and former addresses, phone numbers, email accounts, and employer information. These details can be cross-referenced with data from previous breaches to map out family relationships, children’s names and schools, and even gaming usernames. Credential leaks from this type of incident frequently cascade into account takeovers, especially when the same password has been reused on personal email, banking, or children’s gaming accounts. A single exposed home address from a foreclosure or REO file can endanger every person living at that location.

The Gentlemen Ransomware Group’s Track Record

Public reporting attributes the emergence of The Gentlemen to mid-2024. The group is known for targeting mid-sized professional services firms, including law practices and consultancies. Their typical playbook involves initial access through phishing or exploited remote desktop services, followed by exfiltration of documents before encryption. Rather than always deploying ransomware, they frequently rely on pure extortion, threatening to release sensitive client data unless payment is made. Previous victims listed by the group have included entities in legal, healthcare-adjacent, and financial-adjacent sectors. The Gentlemen maintain a relatively low public profile compared with larger ransomware operations but have shown willingness to publish substantial document volumes when victims refuse to pay.

What to Do

• Run a DoxxScan to map every link between your email addresses, phone numbers, usernames, and real-world identity, then complete the no-subscription cleanup of records tied to your own details.
• Enable continuous DoxxScan monitoring across 13.1 billion breach records and more than 100 platforms so the next time your information appears it is caught and addressed within hours rather than months.
• Rotate any password you have ever used at hwmlawfirm.com or with Halliday, Watkins & Mann anywhere else it is reused, and switch to 2FA using an authenticator app instead of SMS.
• Let remediation specialists handle takedown requests for your personal information across data brokers and people-search sites that may now be seeded with data from this incident.
• Note that any leaked home address or mortgage-related record from the firm can expose everyone at that address; only your own authorized removal actions can effectively take your details out of circulation.

The incident underscores how even a single unconfirmed ransomware claim can place sensitive personal and financial records into the hands of criminals who specialize in long-term extortion. Protecting yourself requires more than reactive checks — it demands ongoing visibility into where your information surfaces and decisive action to break the identity chains that attackers exploit. DoxxScan by GalaxyWarden delivers that combination of continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists who understand exactly how these leaks connect to gaming accounts, family addresses, and future targeting risks.