Leland Campbell LLP law firm Listed by medusa Ransomware Group

On May 23, 2023, Leland Campbell LLP, the largest law firm in Yorkton, Saskatchewan, appeared on the leak site operated by the Medusa ransomware group. The listing states that internal files were exfiltrated during a ransomware attack on the firm, which employs eight lawyers and support staff and handles real estate transactions, wills and estates, criminal defence, family law, civil litigation and commercial matters. The number of people whose information was taken remains unknown, and the leak-site posting does not specify which exact documents or client records were copied.

Primary Disclosure Details

The Medusa leak site entry, still accessible via the .onion link indexed by ransomware.live, states that Leland Campbell LLP suffered a ransomware intrusion and that attackers successfully removed internal files before encryption. No client count, exact data inventory, or ransom amount is published on the listing. The disclosure indicates the data was obtained through a ransomware attack and is now hosted for anyone who visits the extortion portal. Public reporting on Medusa’s past behaviour shows the group routinely posts samples or full archives when victims do not pay.

Why This Matters for You and Your Family

If you or any member of your family has ever used Leland Campbell LLP for a home purchase, a will, a divorce, a criminal charge or any civil dispute, your personal information may sit inside the stolen files. Law-firm records routinely contain full names, dates of birth, Social Insurance Numbers, financial account details, property addresses, family relationships and sensitive legal correspondence. Once that material leaves the firm’s control, it can be searched, sold or published without your knowledge. The breach therefore creates long-term exposure for every past and current client and, by extension, their spouses, children and business partners listed in the same documents.

Doxxing and Identity-Chain Risks

Ransomware operators like Medusa do not limit themselves to one leak. Stolen law-firm data frequently becomes the starting point for doxxing chains that link your professional identity to personal email addresses, phone numbers, social-media accounts and even children’s gaming usernames. A single address or phone number recovered from a real-estate closing file can be cross-referenced with credential leaks from other breaches, allowing attackers to take over online accounts, impersonate family members or demand further payment to prevent release of private family matters. Credential leaks like this one cascade into account takeovers that can compromise gaming accounts belonging to you or your children, turning a legal-matter breach into persistent identity abuse across multiple platforms.

Medusa Group Track Record

Public reporting attributes the first appearance of the Medusa ransomware group to mid-2021. Since then the gang has targeted organisations across North America, Europe and Australia, with a focus on mid-sized professional-services firms, manufacturers and local government entities. Their typical playbook begins with phishing or exploitation of remote-desktop services for initial access, followed by lateral movement to exfiltrate documents before deploying encryption. Medusa then waits a short period and publishes victim data on their leak site if the ransom is not paid, often releasing sample files to pressure negotiations. The group’s extortion style combines data theft with the threat of public release rather than pure encryption, a pattern consistent with the Leland Campbell LLP listing.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers and real identity, including any references that may appear in the stolen law-firm files (cleanup of Warden).
• Rotate every password you have ever used at Leland Campbell LLP or any related service, then enable 2FA through an authenticator app instead of text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your information is caught in hours rather than months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts, which often become targets when parent data leaks and creates doxxing chains.
• Let remediation specialists handle takedown requests for any exposed documents or personal details found on data-broker and extortion sites.

The Medusa listing of Leland Campbell LLP is a reminder that even a single professional-services breach can expose years of private family and financial history. Acting quickly on credential hygiene and identity mapping limits how far attackers can travel down the chain. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that connects online handles to real identities, and hands-on remediation by specialists who manage takedowns for you and every member of your household, including children’s gaming accounts that frequently become collateral damage in these incidents.