Jack Levine Listed by dragonforce Ransomware Group

On December 6, 2025, the ransomware group known as dragonforce added accounting firm Jack Levine PA CPAs to its public leak site, claiming that internal files had been exfiltrated from the Miami-based boutique CPA practice.

What Public Reporting Shows

Public reporting indicates the firm, which specializes in corporate tax, accounting for businesses, individuals, estates, trusts, real estate, healthcare, e-commerce, and not-for-profit organizations, suffered a ransomware attack. The dragonforce leak site lists the incident and states that internal files were stolen. Available reporting describes the firm as a 35-year-old practice located in Miami’s Midtown/Wynwood area that serves clients primarily in South Beach, Miami Beach, and surrounding neighborhoods. Exact volume of records exposed remains undisclosed, and the specific types of client data contained in the exfiltrated files have not been detailed in public postings. The listing appeared on the group’s onion site, which is tracked by ransomware monitoring services such as ransomware.live.

Why This Matters for You and Your Family

If you or anyone in your family worked with Jack Levine PA CPAs, your tax returns, Social Security numbers, financial statements, addresses, and other personal documents may now sit on a criminal leak site. Tax and accounting data is especially dangerous because it contains multi-year histories that fraudsters can use to file fake returns, open accounts, or impersonate you with banks and government agencies. Even if your name is not publicly posted, the mere fact that the firm’s internal files are in criminal hands means your information could surface weeks or months later in follow-on sales or doxxing packages. Families often share accountants, so one breach can quietly expose spouses, dependents, and even adult children who were listed on joint returns or estate documents.

The Doxxing and Identity-Chain Implications

Stolen accounting files rarely stay isolated. Criminals combine them with email addresses, phone numbers, and login credentials found in other breaches to build complete identity chains. A single leaked tax document can link your real name to gaming usernames, family email accounts, or children’s online profiles. Once mapped, these chains allow attackers to hijack accounts, demand ransom from relatives, or publish personal details on doxxing forums. Credential leaks like this one routinely cascade into gaming account takeovers, especially for households where family members reuse passwords or security questions derived from personal tax information.

Dragonforce Group’s Publicly Known Track Record

Public reporting attributes dragonforce with emerging in 2024 as a ransomware operation that combines double-extortion tactics with data leak sites hosted on the dark web. The group has listed dozens of organizations ranging from small businesses to mid-sized service firms, typically gaining initial access through phishing, remote desktop protocol weaknesses, or stolen credentials. After exfiltration, dragonforce follows a standard playbook: it gives victims a short negotiation window, then publishes samples and eventually dumps full archives if demands are unmet. Its leak site functions both as a shaming mechanism and a marketplace for other criminals to browse stolen data.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real identity so you can see exactly what chains back to the Jack Levine breach.
• Rotate any password you ever used at the firm anywhere it has been reused, and immediately enable two-factor authentication through an authenticator app rather than text messages.
• Enable continuous DoxxScan monitoring across 13.1 billion+ breach records and more than 100 platforms so the next exposure of your data is caught and addressed in hours instead of months.
• Cover the entire household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often become targets when credential leaks create doxxing chains.
• Let remediation specialists handle takedown requests across data brokers and leak sites while you focus on securing your own accounts and monitoring tax filings for suspicious activity.

The Jack Levine PA CPAs breach is a reminder that even long-established local firms can become gateways to personal exposure. Acting quickly on the credentials and documents now circulating can limit damage before identity thieves complete their chains. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full family and household coverage that explicitly includes children’s gaming accounts. Start your DoxxScan trial today to map and close the gaps this incident created.