sslf.local Listed by incransom Ransomware Group

On July 30, 2026, the ransomware group incransom listed the law firm Samuels & Thornton on its leak site, claiming the New Orleans-based personal injury and medical malpractice practice had been hit by a ransomware attack in which internal files were exfiltrated. The firm has not, as of this writing, issued any public confirmation or breach notification.

Primary Disclosure Details

The incransom leak-site listing states that Samuels & Thornton suffered a ransomware incident and that internal files were exfiltrated. The posting does not specify the volume of data taken, the exact types of records involved, any ransom demand, or a publication deadline. Because the sole primary source is the threat actor’s own leak site, this remains an unconfirmed claim. Samuels & Thornton has not publicly acknowledged the incident, and no regulator, state attorney general, CISA, or HHS filing has yet appeared.

Why This Matters to You and Your Family

If you or any member of your family has been a client of Samuels & Thornton, your sensitive personal information may be at risk. Law firms handling medical malpractice and personal injury cases routinely hold medical records, insurance details, Social Security numbers, financial information, addresses, phone numbers, and detailed narratives about accidents and injuries. Even though the exact contents listed by incransom remain unknown, the exposure of such data can lead to identity theft, insurance fraud, and targeted scams that directly affect ordinary families.

Doxxing and Identity-Chain Risks

A single breach at a law firm often becomes the starting point for larger doxxing chains. Threat actors can combine leaked client files with information from other breaches to link email addresses, phone numbers, and physical addresses to real identities. This mapping makes it easier for criminals to impersonate victims, file fraudulent tax returns, open accounts in their names, or harass them using personal details uncovered in case files. Credential leaks from such incidents frequently cascade into gaming account takeovers, especially for children and teenagers who reuse passwords or email addresses tied to family legal matters.

incransom’s Known Track Record

Public reporting attributes incransom as a relatively new double-extortion ransomware operation that emerged in late 2025. The group follows a standard playbook: initial access through phishing or exploited remote desktop services, deployment of ransomware to encrypt systems, exfiltration of sensitive files before encryption, and subsequent extortion demands backed by the threat of publishing stolen data on their leak site. Prior victims listed by the group have included small-to-medium law firms, healthcare providers, and local government entities. Like many contemporary ransomware actors, incransom combines automated tooling with manual negotiation, often pressuring victims by selectively leaking sample documents.

What to Do

• Run a DoxxScan to map every link between your email addresses, phone numbers, usernames, and real-world identity so you can see exactly what chains back to the Samuels & Thornton matter.
• Rotate any password you ever used at the firm or on related accounts, then enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1 billion+ breach records and more than 100 platforms so the next exposure of your information is caught within hours instead of months.
• Cover your entire household with DoxxScan family protection, which includes dependents and children’s gaming accounts that often become targets when credential leaks chain back to a shared family address.
• Let DoxxScan remediation specialists manage data-broker takedown requests and opt-out processes on your behalf while you focus on securing your accounts.

The most important forward step is treating every unconfirmed ransomware claim as a prompt to lock down your personal exposure before opportunistic criminals exploit it. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with full household coverage that explicitly protects children’s gaming accounts from the kind of credential-based takeovers that frequently follow incidents like this one.