Thompson Dorfman Sweatman Listed by Obscura Ransomware Group

On October 30, 2025, Canadian law firm Thompson Dorfman Sweatman appeared on the leak site of the obscura ransomware group with 250 GB of internal files listed for public release. The firm, which reported annual revenue of $31.2 million, now faces an eight-day countdown before the attackers begin publishing the stolen data.

What Public Reporting Shows

Public reporting indicates the law firm was compromised in a ransomware incident. The obscura group exfiltrated 250 GB of internal documents and posted proof of the breach on its dark-web leak portal. As of the listing date, the data had not yet been published, and a deadline of roughly eight days remained. No Reported Details have emerged about the precise number of client or employee records contained in the archive or the exact systems initially breached. Available reporting describes the exposed material as internal files without specifying categories such as client contracts, billing records, or personally identifiable information.

Why This Matters for You and Your Family

When a law firm’s internal files are stolen, the information often includes names, addresses, dates of birth, Social Security numbers, financial details, and correspondence tied to wills, divorces, real-estate deals, or personal injury claims. If your family has ever worked with Thompson Dorfman Sweatman or any firm that shares data with them, your information could be inside that 250 GB archive. Once posted publicly, the files become searchable on the open internet, turning a private legal matter into permanent, easily exploited data. Criminals can use even small fragments to open accounts, file fraudulent taxes, or impersonate you in official correspondence. Children’s records, sometimes included in family legal files, are especially attractive because they typically lack credit history and can remain undetected for years.

The Doxxing and Identity-Chain Implications

A single breach rarely stops at the first leak. Attackers and subsequent opportunists combine the newly exposed data with information already circulating on forums and breach repositories. An email address found in the Thompson Dorfman Sweatman files can be linked to gaming accounts, social-media handles, or school records. This creates an identity chain that maps your online activity back to your real name and home address. Credential leaks of this kind frequently cascade into account takeovers, especially for gaming platforms where children often reuse passwords or security questions derived from family information. Once an attacker controls one account, they can harvest more details, pivot to financial services, or sell the full profile on underground markets. The speed at which these chains form leaves most families unaware until damage appears in the form of unauthorized charges, phishing campaigns, or physical intimidation.