Tapper Cuddy LLP Listed by Storm Ransomware Group

The Storm ransomware group has listed Tapper Cuddy LLP on its leak site. According to the listing, the Canadian law firm appears in connection with an alleged ransomware-extortion incident. The company has not publicly confirmed the claim as of this writing. The filing date is September 09, 2026, and the record provides no separate incident date, no count of affected individuals, and no specific categories of information.

What a Leak-Site Listing Actually Establishes

Leak-site postings are produced by the ransomware group itself as part of its extortion campaign. The group posts samples or claims to pressure the victim into paying. These listings are frequently exaggerated, recycled from older data, or sometimes entirely false. Many law firms appear on such sites precisely because client data is sensitive and the threat of public exposure is meant to accelerate payment.

A listing alone does not constitute proof that any breach occurred, that data was successfully exfiltrated, or that any specific records were taken. Real confirmation would require an admission by the firm, a regulatory filing with detailed findings, or independent verification by a third party. Until one of those appears, this remains an unverified accusation by an interested party. The absence of confirmation from Tapper Cuddy LLP is therefore significant.

The Pattern in the Legal Sector

Ransomware groups have repeatedly targeted law firms and then listed them on leak sites when payment is refused. The tactic exploits the fact that legal practices hold highly sensitive client information across litigation, family law, and commercial matters. Even the suggestion of exposure can damage client trust, which is why firms often face pressure to resolve quietly.

For you as a client or former client, this pattern means you should assume that any law firm you have worked with could eventually face similar claims. The useful takeaway is to maintain good password hygiene across all professional-service accounts and to watch for any direct notification from the firm itself. The filing does not state when the alleged incident occurred, so the only reliable way to learn whether your specific records were involved is a direct letter from Tapper Cuddy LLP.

Absence of such a letter usually indicates you were not in the affected group. However, because addresses change, anyone who has moved since the events in question should contact the firm directly to confirm their status.