Buff Law Listed by spacebears Ransomware Group

On February 10, 2026, the Buffalo, New York law firm Rosenthal, Kooshoian & Lennon, LLP appeared on the leak site of the spacebears ransomware group. Internal files containing clients’ personal data, court decisions, and evidence were allegedly exfiltrated after a ransomware attack on the firm’s systems. Anyone who has ever been a client of the firm, or whose legal matters passed through it, may now have sensitive information exposed.

What's Publicly Reported from Reporting

Public reporting indicates the firm, which has operated for more than 70 years and focuses on personal injury, criminal defense, wrongful death, product liability, and DUI/DWI cases, had data taken during a ransomware incident. The spacebears group posted proof of the breach on its dark-web leak site, listing the company under the name “Buff Law.” Available reporting describes the exposed material as internal files that include client personal information, legal documents, and case evidence. The exact number of affected individuals remains unknown, but the nature of a plaintiff-side personal-injury and criminal-defense practice means the records likely contain names, addresses, dates of birth, Social Security numbers, medical records, insurance details, and court filings for thousands of people and their families.

Why This Matters for You and Your Family

If you or anyone in your household has used this firm for a car accident, slip-and-fall, criminal charge, or any related matter, your private information may now be in the hands of criminals. Clients’ personal data can be sold, traded, or used to open fraudulent accounts, file fake tax returns, or impersonate you with insurance companies and courts. For families, the exposure can affect everyone living at the same address because legal files often list spouses, children, and dependents. Once your information is loose on criminal forums, it rarely disappears. The breach turns a private legal matter into a permanent public vulnerability that can follow you for years.

The Doxxing and Identity-Chain Implications

Legal-case files frequently link your real name, home address, phone number, email, and sometimes driver’s license or Social Security number. Attackers combine this data with information from other breaches to build detailed profiles. A single leaked email or phone number can connect your gaming username, social-media handles, and family members’ accounts. Credential leaks like this one often cascade into account takeovers on email, banking, or gaming platforms. Children’s gaming accounts are especially at risk because parents frequently reuse passwords or recovery details tied to the same household address. The result is a doxxing chain that can expose your entire family’s digital life.

Spacebears Group Track Record

Public reporting attributes the attack to the spacebears ransomware group. The group emerged in late 2024 and has targeted mid-sized businesses and professional services firms. Notable prior victims include other law practices and healthcare providers whose client and patient records were posted when ransom demands went unpaid. Their typical playbook involves initial access through phishing or exploited remote-desktop services, followed by exfiltration of sensitive files before encryption. They then pressure victims with a short deadline, publishing samples on their leak site when payment is not received. The group’s extortion style relies on the threat of releasing confidential client or patient data rather than solely on system downtime.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity so you can see exactly what chains back to the Buff Law breach.
• Rotate the password you used with the firm anywhere it is reused and switch to 2FA through an authenticator app on every account that allows it.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak that touches you or your family is caught in hours, not months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that could be reached through the same leaked address or credentials.
• Let remediation specialists handle takedown requests across data brokers and exposed profiles while you focus on securing your own accounts.

The Buff Law breach shows how quickly a single professional services incident can ripple into long-term identity risk for ordinary families. Taking deliberate steps now limits what criminals can build from the stolen files. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Start your DoxxScan trial today and close the gaps before the next wave of abuse begins.