Dutton Brock Listed by ALPHV Ransomware Group

On January 29, 2024, Canadian insurance litigation firm Dutton Brock appeared on the leak site operated by the alphv ransomware group. The listing states that internal files were exfiltrated during a ransomware attack on the firm, which was founded in 1982 and handles cases involving appeals, class actions, commercial litigation, construction disputes, coverage questions, and cyber liability.

Reported Details from the Listing

The alphv leak site entry, accessible via the .onion link mirrored on ransomware.live, states that attackers obtained internal files from Dutton Brock. The disclosure does not specify the volume of data taken, the exact types of documents involved, or the number of individuals whose information appears in the files. It simply states that data was exfiltrated and gives the firm a deadline to negotiate before samples or larger portions are published. No client lists, policy documents, or personal records are described in the public portion of the listing itself.

Why This Matters for You and Your Family

If you or anyone in your household has ever been represented by Dutton Brock, worked with one of their clients, or had personal information included in an insurance claim or litigation file handled by the firm, your details may now sit in a ransomware operator’s archive. Internal files from a litigation practice routinely contain names, addresses, dates of birth, Social Insurance Numbers, medical records, financial details, and correspondence that can be used for identity theft or fraud. Even though the exact scale remains unknown, the mere presence of a law firm on an active ransomware leak site means the clock is ticking for anyone whose records were stored on the compromised systems.

The Doxxing and Identity-Chain Risks

Ransomware groups rarely stop at posting generic “proof” files. Once internal documents surface, opportunistic criminals scrape names, emails, phone numbers, and addresses, then cross-reference them with other breaches. A single leaked insurance file can link your work email to a personal phone number, a child’s school records, or a spouse’s banking details. These connections form doxxing chains that lead to targeted phishing, SIM-swapping, or full identity takeover. Gaming accounts belonging to children are especially vulnerable because the same password or recovery email reused from a family member’s professional matter can hand over an entire digital life.

Alphv’s Known Track Record

Public reporting attributes the alphv group, also known as BlackCat, with emerging in late 2021. The gang has since hit hundreds of organizations across North America and Europe, including healthcare providers, manufacturers, and professional services firms. Their typical playbook begins with initial access gained through compromised credentials or exploited remote desktop services, followed by rapid lateral movement, data exfiltration, and deployment of custom ransomware. After encryption they demand payment and, if unmet, publish stolen data on their leak site while simultaneously contacting victims’ customers and partners to increase pressure. The group frequently rotates infrastructure and rebrands, making them persistent even after law-enforcement actions.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, including any ties to Dutton Brock matters.
• Rotate passwords used at Dutton Brock or any related insurance provider anywhere they are reused, and switch to 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts that often chain back to the same addresses and recovery emails.
• Let remediation specialists handle takedown requests across data brokers and leak sites on your behalf while you focus on securing your own accounts.

The alphv listing of Dutton Brock is a concrete reminder that professional services firms hold some of the most sensitive personal data families possess. Acting quickly on credential hygiene and identity mapping can break the chain before criminals turn stolen litigation files into long-term fraud or harassment. DoxxScan by GalaxyWarden delivers that continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with household coverage that explicitly includes children’s gaming accounts vulnerable to cascading takeovers.