Doak Shirreff Lawyers listed on direwolf leak site

• Ransomware group: direwolf
• Country: Canada
• Sector: Professional Services
• Announcement date: July 8, 2025

Canada-based law firm targeted by direwolf

The threat actor known as direwolf has listed the Canadian law firm Doak Shirreff Lawyers on its leak site. According to an announcement made on July 8, 2025, the group claims to have successfully compromised the organization's systems and exfiltrated a significant amount of sensitive information.

The incident was announced on July 8, 2025, with the group alleging that they have stolen 70 GB of data belonging to the firm. The threat actor has set a deadline for the release of the stolen information, claiming that the full dataset is scheduled to be published on July 30, 2025. Information regarding the specific identity and background of the direwolf group remains limited in the public domain.

Claimed data types and impact

The announcement from the threat actor specifies that the breach involves highly sensitive information. The group claims that the following types of data have been compromised:

• Credit card data
• Legal documents

The exposure of such information carries significant implications for both the organization and its clients. The alleged theft of credit card information could potentially lead to financial loss and identity theft for the individuals whose data was targeted. Furthermore, the disclosure of confidential legal documents poses a severe risk to client privacy and could result in substantial reputational damage for the law firm.

Organization profile

Doak Shirreff is a full-service law firm located in Kelowna, British Columbia, Canada. The firm provides a wide range of professional legal consulting and representation services across various practice areas to its clients.

Analysis and industry implications

The alleged data exfiltration represents a serious threat to client confidentiality and financial security. Because Doak Shirreff Lawyers operates within Canada, this incident may trigger specific regulatory obligations under the Personal Information Protection and Electronic Documents Act (PIPEDA). The use of double extortion tactics—a method where attackers not only encrypt data but also threaten to leak it—can significantly increase the pressure on an organization to meet ransom demands and may facilitate secondary attacks against the victim.

In the professional services sector, maintaining the integrity and privacy of client data is a fundamental requirement. When such data is compromised, organizations often face complex legal and regulatory landscapes. To mitigate the risks associated with such threats, organizations in this sector typically focus on several defensive strategies. Implementing robust encryption for data at rest and in transit can help protect sensitive information from being readable even if exfiltrated. Furthermore, strict access controls and multi-factor authentication are essential to prevent unauthorized entry into sensitive networks.

Regular security audits and comprehensive data protection frameworks are also vital for professional service providers. Organizations must be prepared to respond to such incidents through established incident response plans, which include notifying regulatory bodies and affected individuals as required by law. As threat actors continue to target high-value sectors like legal services, the necessity for proactive cybersecurity measures and strict adherence to privacy regulations remains a critical priority for maintaining trust and operational continuity.