lindenlaw.com Listed by incransom Ransomware Group

On August 13, 2025, the Michigan probate law firm Howard T. Linden, P.C. appeared on the leak site of the ransomware group known as incransom. The firm’s internal files were allegedly exfiltrated during a ransomware attack, exposing sensitive documents that may contain personal information belonging to clients, families, and other parties involved in probate, wills, trusts, guardianships, and wrongful-death settlements.

Reported Details of the Incident

Public reporting indicates that Howard T. Linden, P.C., a firm with nearly 50 years of experience focused exclusively on Michigan probate law, had data stolen and listed for disclosure on the incransom leak site. The exposed material consists of internal files taken during the ransomware operation. The exact number of individuals affected remains unknown, and the specific types of personal data contained in the files have not been publicly detailed. The listing appeared on the group’s onion-site blog, which serves as their primary disclosure platform.

Why This Matters for You and Your Family

When a law firm handling wills, trusts, guardianships, and death-related settlements is breached, the information at risk often includes full names, addresses, Social Security numbers, financial details, family relationships, and medical or court records. If your family has ever worked with a probate attorney in Michigan — even years ago — your data could be among the stolen files. Once published, this information does not disappear. It can be sold, reposted, or used to target you or your relatives with identity theft, fraudulent loan applications, or more personalized scams.

The Doxxing and Identity-Chain Risks

Ransomware leaks like this one rarely stop at a single company. Criminals frequently cross-reference the newly exposed documents with data from earlier breaches to build detailed profiles. A phone number listed in a guardianship file can be linked to an email from an old retail breach; an address in a trust document can be tied to a child’s gaming username. These identity chains allow attackers to move from leaked paperwork to doxxing, account takeovers, and extortion. Credential leaks cascade quickly into gaming accounts belonging to you or your children, turning one firm’s breach into a household-wide exposure.

Incransom’s Publicly Known Track Record

Public reporting attributes the incransom group with operating a double-extortion model: they encrypt victim systems, exfiltrate data, then threaten to publish it unless ransom is paid. The group emerged in recent years and has listed multiple organizations on its leak site, typically giving victims a short deadline before releasing samples or full datasets. Their playbook usually involves initial access through common vectors such as phishing or unpatched remote desktop services, followed by lateral movement to locate valuable files, exfiltration, and finally public shaming on their onion blog when payments are refused.

What to Do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup to remove what you can.
• Enable continuous DoxxScan monitoring across 13.1 billion+ breach records and more than 100 platforms so the next exposure is caught in hours rather than months.
• Rotate any password you used at lindenlaw.com or with the firm anywhere else it is reused, and switch on two-factor authentication through an authenticator app instead of text messages.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often chain back to the same addresses or family emails exposed in legal files.
• Let remediation specialists handle takedown requests across data brokers and leak sites so you do not have to chase every copy manually.

The incident shows that even long-established local firms can become gateways for identity theft that reaches your front door. Acting quickly on the credentials and links already circulating can limit the damage. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and 100-plus platforms, AI-powered identity-chain mapping that connects online handles to real identities, and hands-on remediation by specialists who manage takedowns for the entire household, including children’s gaming accounts that are frequently targeted once a family address surfaces.