Miller & Caggiano Listed by dragonforce Ransomware Group

On April 9, 2025, the law firm Miller Caggiano & Kaplan, LLP appeared on the leak site of the dragonforce ransomware group. The firm, which specializes in disability claims for injured and disabled workers, had internal files exfiltrated during a ransomware attack. While the exact number of people whose information was taken remains unknown, anyone who has worked with the firm, submitted a claim, or had their records stored there could be affected.

What's Publicly Reported from Reporting

Public reporting indicates that Miller Caggiano & Kaplan was listed on the dragonforce leak site on April 9, 2025. The data exposed consists of internal files that the attackers say they exfiltrated before encrypting systems. No specific count of records or detailed list of data types has been publicly confirmed beyond the broad description of internal documents. The firm’s own description notes its focus on helping union members and workers navigate disability claims, which means client files likely contain personal details such as medical records, employment history, Social Security numbers, addresses, and financial information related to claims.

Why This Matters for You and Your Family

When a law firm that handles sensitive worker-compensation cases is breached, the information stolen often belongs to ordinary people who sought help after workplace injuries. If your disability claim, medical records, or union-related paperwork passed through Miller Caggiano & Kaplan, your personal data may now sit on a ransomware leak site. That exposure can lead to identity theft, fraudulent loan applications, tax fraud, or targeted scams that feel very personal. For families, one breach can affect everyone listed on joint claims, shared addresses, or dependent records.

Credential leaks like this one frequently cascade into account takeovers on other services where the same email and password were reused.

The Doxxing and Identity-Chain Implications

Ransomware operators rarely stop at posting a single company’s files. Once internal documents are public, opportunistic criminals scrape names, emails, phone numbers, and addresses, then cross-reference them across social media, gaming platforms, and data-broker sites. This creates an identity chain that links your professional life to personal accounts. A seemingly minor detail in a disability claim file—such as a child’s name or a family address—can be combined with a reused password from a gaming account to unlock further exposure. The result is doxxing that can escalate from nuisance spam to harassment or financial fraud.

Dragonforce Group Track Record

Public reporting attributes the attack to the dragonforce ransomware group. The group emerged in recent years and has targeted organizations across multiple sectors with a playbook that typically involves initial access through phishing or exploited remote services, followed by data exfiltration and deployment of ransomware. After encryption, they demand payment and, if unpaid, publish samples or full datasets on their leak site to pressure victims. Their prior victims have included companies of varying sizes, and their extortion style relies on both operational disruption and public shaming through data leaks.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real identity so you can see exactly what chains back to the Miller Caggiano & Kaplan breach.
• Rotate any password you used at the firm anywhere else it appears, then enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information surfaces you learn within hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and your children’s gaming accounts, which often become entry points when credential leaks cascade into takeovers.
• Let remediation specialists handle takedown requests across data brokers and suspicious sites while you focus on securing your own accounts.

The incident shows that even specialized law firms handling everyday worker claims can become targets, and the fallout can reach your family faster than expected. Starting with clear visibility into where your information already appears online gives you the best chance to limit damage before it spreads further. DoxxScan by GalaxyWarden delivers that visibility through continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts.