Morris-Sockle Listed by qilin Ransomware Group

On October 14, 2025, Morris-Sockle, PLLC, a family law and divorce firm with more than 40 years in practice, appeared on the leak site of the qilin ransomware group. The firm’s internal files were allegedly exfiltrated during a ransomware attack, placing sensitive client records at risk of public release or sale.

Reported Details from Reporting

Public reporting indicates that qilin posted Morris-Sockle data on its leak portal, accessible via a Tor address tracked by ransomware.live. The listing confirms successful exfiltration of internal files, though the exact volume and full list of exposed data types have not been independently verified. No confirmed victim count has been released by the firm or the attackers. The incident follows the typical ransomware pattern of encryption followed by data theft and extortion pressure.

October 14, 2025 marks the public listing date. The firm specializes in divorce, custody, and post-divorce matters, meaning the stolen files are likely to contain names, addresses, financial details, court documents, and other personal identifiers belonging to clients and their families.

Why This Matters for You and Your Family

When a family law firm is breached, the people most exposed are often those already going through some of the most difficult periods in their lives. Divorce records, child custody agreements, domestic support orders, and financial affidavits can contain exactly the information needed for identity theft, harassment, or targeted scams. If your attorney’s office uses Morris-Sockle, your private information may now sit on a criminal leak site.

Even if you were never a client, these incidents remind us how easily personal legal matters can escape controlled environments. One breach can hand criminals the roadmap to your life: where you live, how much you earn, who your children are, and what vulnerabilities exist in your current situation.

The Doxxing and Identity-Chain Risk

Legal documents frequently link your full name, date of birth, address, phone numbers, email accounts, and sometimes Social Security numbers. Attackers do not stop at the first record. They combine it with data from earlier breaches to build an identity chain that can reveal your social-media handles, your children’s gaming usernames, and even the schools or after-school programs your family uses.

Credential leaks of this kind often cascade. A password reused from an old divorce-case portal can give attackers access to your email, which then unlocks banking, tax, and social accounts. Children’s gaming accounts tied to the same household email or phone number become easy secondary targets for doxxing or extortion.

Qilin’s Publicly Known Track Record

Public reporting attributes the attack to the qilin ransomware group. The group emerged in 2022 and has since targeted organizations across healthcare, legal, education, and technology sectors. Notable prior victims include several mid-sized law firms and healthcare providers whose client data appeared on the same leak site. Qilin’s typical playbook involves initial access through phishing or exploited remote desktop credentials, followed by lateral movement, data exfiltration, deployment of ransomware, and finally publication of samples on their Tor leak portal when victims refuse to pay. The group’s extortion style combines threats of data release with deadlines that can range from days to several weeks.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup of exposed records.
• Rotate any password you ever used at Morris-Sockle or related legal portals anywhere it has been reused, and switch to 2FA through an authenticator app rather than text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your information is caught in hours, not months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts that often chain back to the same address or email.
• Let remediation specialists handle takedown requests across data brokers and leak sites for you while you focus on securing your own accounts.

The Morris-Sockle breach is another reminder that your personal data is only as safe as the vendors you trust with it. Taking concrete steps now can limit how far an attacker can travel down the identity chain before you discover and stop them. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes your children’s gaming accounts. Start your DoxxScan trial today to see exactly what is already exposed and close those doors before the next incident occurs.