Thilges & Bernhardt, Attorneys at Law Listed by qilin Ransomware Group

On January 12, 2025, the qilin ransomware group listed Thilges & Bernhardt, Attorneys at Law on its leak site and announced that all of the firm’s internal files would be made available for public download on 19 January 2025.

Reported Details of the Incident

Public reporting indicates the Missouri-based family law firm was hit by a ransomware attack in which attackers exfiltrated internal documents before encrypting systems. The qilin leak page states that the entire cache of stolen data will become freely downloadable after the deadline. The firm, originally founded in 1991, now operates with four attorneys focused exclusively on family law matters including divorce, child custody, and related personal legal issues. No exact victim count has been published, and the precise volume or sensitivity of the files remains unknown to the public at this time.

Why This Matters for You and Your Family

When a family law firm suffers a breach, the people most likely to be exposed are the firm’s own clients — ordinary individuals and families who shared highly personal information during divorce, custody battles, or support cases. Names, addresses, financial records, children’s school and medical details, and private correspondence may now sit on a ransomware leak site. Once that material reaches public forums or data brokers, it can be used for identity theft, harassment, or targeted scams. Even if you are not a current client, the precedent is clear: any professional who holds sensitive data about your household can become a gateway to your private life.

The Doxxing and Identity-Chain Risks

Family law files frequently contain multiple overlapping identifiers — email addresses, phone numbers, children’s names, social-media handles, and employer details. Attackers and opportunistic criminals can chain these fragments together to build a complete profile. A single leaked custody document can link a parent’s work email to a child’s gaming username, exposing both to account takeovers or physical doxxing. Credential leaks of this nature routinely cascade into gaming account compromises, especially for children who reuse passwords or security questions derived from family information.

Qilin’s Publicly Known Track Record

Public reporting attributes the attack to the qilin ransomware group. The gang emerged in 2022 and has since targeted organizations across healthcare, legal, education, and manufacturing sectors. Notable prior victims include several U.S. healthcare providers and professional services firms. Their typical playbook involves initial access through phishing or exploited remote desktop services, followed by data exfiltration, encryption of victim systems, and dual extortion: demanding ransom for decryption keys while threatening to publish stolen files on their leak site if payment is not made. In this case, the group has set a firm publication deadline of 19 January 2025.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity so you can see exactly what chains back to the law firm’s leaked files.
• Rotate any password you ever used at Thilges & Bernhardt anywhere else it is reused, and switch to 2FA through an authenticator app rather than text messages.
• Enable continuous DoxxScan monitoring across 13.1 billion+ breach records and more than 100 platforms so the next exposure of your data is caught in hours instead of months.
• Cover the entire household with DoxxScan family protection, which extends to dependents and children’s gaming accounts that often connect to the same leaked addresses or security questions.
• Let remediation specialists handle takedown requests across data brokers and leak sites while you focus on securing your own accounts.

The incident underscores a simple reality: your personal data is only as safe as the professionals you trust with it. Taking concrete steps now can limit the damage from this leak and reduce exposure the next time a vendor or service provider is breached. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts — practical protection for the families whose information actually ended up in the wrong hands.