mgrlaw.com Listed by threeam Ransomware Group

On June 12, 2026, the website of Mogren, Glessner & Ahrens, a King County law firm handling family law, divorce, probate, wills, criminal defense, personal injury, and adoption cases, appeared on the leak site of the threeam ransomware group. Internal files were allegedly exfiltrated during a ransomware attack, placing sensitive client and employee information at risk of public release.

What's Publicly Reported from Reporting

Public reporting indicates the firm, established in 1942, had internal documents stolen. The exact number of people affected remains unknown. Available details confirm the data includes records tied to the firm’s core practice areas, which routinely contain names, addresses, financial details, Social Security numbers, medical information, and court filings for thousands of families across Washington state. The threeam leak site listed mgrlaw.com on June 12, 2026, following the exfiltration phase of their ransomware operation.

Why This Matters for You and Your Family

Family law and divorce records often hold the most private details about your household—custody arrangements, financial disclosures, addresses of children, and previous names. When a firm like Mogren, Glessner & Ahrens is breached, that information can spread far beyond the original case. Criminal defense files may expose past charges or ongoing matters. Probate and will documents can reveal inheritance details and family financial structures. Personal injury records frequently include medical histories and insurance data. Any of these can be used for identity theft, targeted scams, or harassment. If you or your family ever worked with this firm or similar local practices, your information could already be in the hands of criminals.

The Doxxing and Identity-Chain Risks

Ransomware leaks rarely stop at one dataset. Criminals combine the newly exposed files with information from previous breaches to build detailed profiles. A single email or phone number found in these internal files can link to your social media, children’s school records, or gaming accounts. Once connected, attackers can impersonate family members, file fraudulent tax returns, or launch doxxing campaigns that publish home addresses and personal histories. Credential leaks of this type frequently cascade into account takeovers, especially for gaming platforms where children often reuse passwords or email addresses tied to family domains.

Threeam Group’s Known Track Record

Public reporting attributes the threeam ransomware group with operations that emerged in recent years. The group typically gains initial access through common vectors such as phishing or exploited remote desktop services, exfiltrates data before encrypting systems, and then posts samples on its leak site while demanding payment to prevent full disclosure. Notable prior victims include other professional services firms whose client files contained similarly sensitive personal information. Their playbook emphasizes extortion through the threat of releasing identity-heavy documents rather than pure encryption alone.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity so you can see exactly what this leak connects to.
• Rotate any password you ever used at mgrlaw.com or similar law firms and enable 2FA through an authenticator app everywhere that password was reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your information is caught in hours rather than months.
• Cover your entire household with DoxxScan family protection, which includes children’s gaming accounts that often chain back to the same addresses and emails now at risk.
• Let remediation specialists handle takedown requests and broker removals for any newly exposed personal records instead of attempting it alone.

The breach of Mogren, Glessner & Ahrens illustrates how quickly professional services data can become fuel for larger identity attacks. Acting quickly on the exposed information gives you the best chance to limit damage before it spreads further. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that explicitly protects children’s gaming accounts vulnerable to credential-stuffing attacks that follow leaks like this one.