Cambria Law Firm Data Breach

Cambria Law Firm, a professional services organization based in Canada, was listed as a victim on the Inc Ransom ransomware group’s dark web portal, with the listing published on August 13, 2026. This discovery was made through SOCRadar’s Dark Web Monitoring service. As a legal practice, Cambria Law Firm operates within Canada’s professional services sector, an area where client privilege and document confidentiality are paramount, making sensitive data a significant target. The ransomware group’s claim aligns with a pattern of Inc Ransom activity that has previously targeted legal and advisory firms. In the 60 days leading up to this listing, Inc Ransom claimed 39 other victims. The group predominantly targets the Professional Services, Healthcare, and Business Services sectors, with a significant concentration of victims located in the United States, Canada, and Australia. Several recent Inc Ransom listings share commonalities with Cambria Law Firm, including other Canadian organizations and professional services firms such as Stuart & Associates Commercial Flooring, Compunnel, Louisville Bar Association, and Liberty Commercial Center. This incident is consistent with Inc Ransom’s ongoing focus on the professional and legal services sector, particularly in North America.

SOCRadar’s analysis of stealer-log telemetry revealed a significant exposure for the cambrialawfirm.com domain. The queried sample yielded 25 records, including 16 employee credentials on endpoints controlled by the organization or linked to its identity systems, 3 records associated with external users on firm systems, and 5 records of corporate usernames linked to third-party SaaS platforms. Critical observed endpoints included an SSO/identity service used for centralized authentication, the firm’s primary domain with direct credential pairs, a legal practice management platform (Cosmolex), a document signing service (DocuSign), and a project management tool (Monday.com). The data indicates a corporate intrusion risk, with the same corporate username appearing across multiple services and dates, suggesting the compromise of a single workstation or a small group of endpoints. The logged entries span from June 26 to August 7, 2026, covering a 43-day period without evidence of credential rotation. For ransomware groups like Inc Ransom, credentials harvested by infostealers serve as a well-established initial access vector. Operators or initial access brokers obtain fresh logs from underground marketplaces, validate the corporate credentials, and subsequently use them to gain access to systems such as Microsoft 365, VPNs, or remote-access portals before deploying ransomware. While the stealer-log evidence does not definitively confirm that these specific credentials were utilized by Inc Ransom, the extent of the exposure, encompassing identity management, case management, document signing, and workflow platforms, is highly indicative of the pre-intrusion reconnaissance phase commonly employed by such threat actors. Law firms, particularly those managing sensitive client data, should treat this as a critical alert requiring immediate credential rotation and thorough endpoint forensics.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.