Thompson Dorfman Sweatman Listed by obscura Ransomware Group

On October 30, 2025, Canadian law firm Thompson Dorfman Sweatman appeared on the leak site of the obscura ransomware group with 250 GB of internal files listed for public release. The firm, which reported annual revenue of $31.2 million, now faces an eight-day countdown before the attackers begin publishing the stolen data.

What's Publicly Reported from Reporting

Public reporting indicates the law firm was compromised in a ransomware incident. The obscura group exfiltrated 250 GB of internal documents and posted proof of the breach on its dark-web leak portal. As of the listing date, the data had not yet been published, and a deadline of roughly eight days remained. No Reported Details have emerged about the precise number of client or employee records contained in the archive or the exact systems initially breached. Available reporting describes the exposed material as internal files without specifying categories such as client contracts, billing records, or personally identifiable information.

Why This Matters for You and Your Family

When a law firm’s internal files are stolen, the information often includes names, addresses, dates of birth, Social Security numbers, financial details, and correspondence tied to wills, divorces, real-estate deals, or personal injury claims. If your family has ever worked with Thompson Dorfman Sweatman or any firm that shares data with them, your information could be inside that 250 GB archive. Once posted publicly, the files become searchable on the open internet, turning a private legal matter into permanent, easily exploited data. Criminals can use even small fragments to open accounts, file fraudulent taxes, or impersonate you in official correspondence. Children’s records, sometimes included in family legal files, are especially attractive because they typically lack credit history and can remain undetected for years.

The Doxxing and Identity-Chain Implications

A single breach rarely stops at the first leak. Attackers and subsequent opportunists combine the newly exposed data with information already circulating on forums and breach repositories. An email address found in the Thompson Dorfman Sweatman files can be linked to gaming accounts, social-media handles, or school records. This creates an identity chain that maps your online activity back to your real name and home address. Credential leaks of this kind frequently cascade into account takeovers, especially for gaming platforms where children often reuse passwords or security questions derived from family information. Once an attacker controls one account, they can harvest more details, pivot to financial services, or sell the full profile on underground markets. The speed at which these chains form leaves most families unaware until damage appears in the form of unauthorized charges, phishing campaigns, or physical intimidation.

Obscura Group’s Publicly Known Track Record

Public reporting attributes the attack to the obscura ransomware group. The group emerged in early 2024 and has targeted organizations across North America and Europe. Notable prior victims include mid-sized law practices, healthcare providers, and manufacturing companies. Their typical playbook begins with initial access gained through phishing or exploited remote-desktop credentials, followed by rapid exfiltration of sensitive files. They then deploy ransomware to encrypt systems and simultaneously threaten to publish the stolen data on their leak site unless a ransom is paid. Extortion demands are usually followed by countdown timers and proof-of-data samples designed to pressure victims into negotiation. When victims refuse or miss deadlines, obscura releases portions or all of the data in batches.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real identity so you know exactly what the Thompson Dorfman Sweatman files could connect to.
• Rotate any password you used at the law firm or any related vendor, then enable two-factor authentication through an authenticator app on every account where that password was reused.
• Enable continuous DoxxScan monitoring across 13.1 billion+ breach records and more than 100 platforms so the next leak exposing you or your family is caught within hours rather than months.
• Cover the entire household with DoxxScan family protection, which extends to dependents and children’s gaming accounts that often chain back to the same address or parent credentials.
• Let remediation specialists handle takedown requests and broker removals for any exposed personal records instead of attempting manual contact with dozens of sites yourself.

The incident underscores a simple reality: legal and financial data you once trusted to remain private can surface with little warning and create long-term exposure for every member of your household. Acting quickly on the credentials and links already circulating can limit the damage before the obscura countdown ends. DoxxScan by GalaxyWarden delivers that speed through continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full family coverage that includes children’s gaming accounts. Start your DoxxScan trial today and close the gaps the attackers are counting on.