Horwitz Horwitz & Associates Listed by Unsafe Ransomware Group

On December 21, 2022, Chicago-based law firm Horwitz Horwitz & Associates appeared on the leak site of the ransomware group known as Unsafe. The listing states that internal files were exfiltrated during a ransomware attack; the exact number of records affected and the specific data types inside those files remain undisclosed by the firm or the threat actor.

Details from the Leak-Site Listing

The primary disclosure on the Unsafe leak portal, archived via ransomware.live, states that Horwitz Horwitz & Associates suffered a ransomware incident in which attackers successfully exfiltrated internal files. No victim count, ransom amount, or sample documents are shown in the public listing. The disclosure indicates the firm is a U.S. entity with roughly $8 million in annual revenue, yet provides no further technical details about the initial access vector or the precise systems compromised. Public reporting on Unsafe’s past behavior suggests the group typically posts a countdown timer before releasing additional proof packets, though that timer had not yet advanced when the listing first surfaced.

Why This Matters for You and Your Family

When a law firm’s internal files are stolen, the exposure often includes client names, addresses, dates of birth, Social Security numbers, medical records, financial details, and legal correspondence. Even though the exact contents are unknown, any family who used Horwitz Horwitz & Associates for personal injury, workers’ compensation, or estate planning between the firm’s founding and late 2022 should treat their personal information as at risk. One breach like this can cascade into tax fraud, medical identity theft, or loan applications opened in your name. Children listed on family legal matters are especially vulnerable because their records often stay untouched for decades, giving thieves a long window to exploit them.

The Doxxing and Identity-Chain Risk

Legal-case files frequently link email addresses, phone numbers, home addresses, and employer details to full names. Attackers can chain these fragments with username leaks from gaming platforms, social-media handles, and older breaches to build a complete identity profile. Once the real name is tied to a gamer tag or Discord account, harassment, swatting, and SIM-swapping become practical. Credential leaks of this kind routinely surface on multiple dark-web markets within weeks, turning a single corporate ransomware incident into months or years of follow-on targeting for you and every member of your household.

Unsafe Group’s Known Track Record

Public reporting attributes Unsafe with emerging in early 2022 and focusing primarily on small-to-medium U.S. businesses and professional-services firms. The group’s playbook typically begins with phishing or RDP brute-force to gain initial access, followed by deployment of commodity ransomware, aggressive data exfiltration, and dual-extortion pressure that combines file-encryption demands with public shaming on their leak site. Notable prior victims listed in open-source trackers include regional manufacturers, healthcare clinics, and other law offices, though exact success rates and average ransom payments remain opaque. The group’s willingness to publish victim data even after partial payment makes every listing a credible long-term threat.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup of Warden to break those chains.
• Rotate any password you ever used at Horwitz Horwitz & Associates wherever it has been reused, and switch on 2FA through an authenticator app instead of SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours rather than months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often become the weakest link in doxxing chains.
• Let remediation specialists handle data-broker takedown requests and opt-out processes on your behalf while you focus on securing accounts.

The Unsafe listing of Horwitz Horwitz & Associates is a reminder that even mid-sized professional firms can become gateways to personal exposure for thousands of ordinary families. Acting quickly on credential hygiene and identity mapping limits how far attackers can travel down the chain. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts at risk from exactly these kinds of cascading leaks.