Inc Ransom ransomware group lists lawofficesoferichershler.com on its leak site

• Ransomware group: Inc Ransom
• Country: United States
• Sector: Professional Services
• Announcement date: March 4, 2026

Inc Ransom claims data breach at law offices of Eric Hershler

The Inc Ransom ransomware group has listed the Los Angeles-based law firm lawofficesoferichershler.com on its dedicated leak site. According to the announcement, the threat actor group claims to have successfully exfiltrated data from the organization. The post, which was discovered on March 4, 2026, identifies the alleged attack date as March 3, 2026. While the group has published a listing, no information was provided regarding the total size of the data stolen, the specific file count, or the ransom demand requested by the attackers.

Details of the alleged leak

The announcement made by Inc Ransom includes various screenshots intended to prove the validity of their claim. These images allegedly contain documents belonging to the firm. Based on the content of these screenshots, the leaked information is highly sensitive, as it includes various forms of identification and personal documentation. The specific types of data identified in the screenshots include:

• Identity information
• Passport details
• Personal data

The presence of such sensitive documentation in a public leak site highlights the severity of the claimed breach. When ransomware groups release screenshots of identity cards and passports, it serves as a method of pressure during negotiations, a tactic often associated with modern cyber extortion campaigns.

Organization profile

The target of this alleged attack is The Law Offices of Eric Hershler, APC. This professional services firm is based in Los Angeles and focuses exclusively on personal injury cases. Given the nature of their legal practice, the firm handles a high volume of sensitive client information related to personal legal matters and individual identities.

Analysis and potential impact

The targeting of a law firm presents significant risks to the individuals involved. Because law firms handle highly sensitive client data, this breach may expose clients to various risks, including identity theft and fraud. The exposure of passports and identity cards provides malicious actors with the necessary components to impersonate victims in various fraudulent schemes.

Furthermore, since the organization is based in the United States, the incident may lead to legal repercussions. The firm may face challenges under state-level data privacy laws and must navigate complex professional confidentiality obligations. The fallout from such a breach often extends beyond immediate data loss, potentially leading to long-term reputational damage for the firm.

Risks of double extortion

Inc Ransom is a ransomware group that emerged in mid-2023. The group is known for employing double extortion tactics. In a double extortion scenario, attackers do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive data before the encryption occurs. This allows them to threaten the public release of the data if the ransom is not paid, creating a secondary layer of pressure on the victim.

The use of these tactics suggests that the publication of data could lead to increased secondary risks. For example, the firm's clients may become targets of highly specific and targeted phishing attacks. In these scenarios, attackers use the stolen personal information to craft convincing messages that appear to come from legitimate sources, further increasing the likelihood of successful social engineering attacks against the victims.

Defensive considerations for professional services

Organizations operating in the professional services sector, particularly those handling legal matters, must prioritize robust data protection strategies to mitigate these risks. Common defensive steps include implementing strict access controls to ensure that only authorized personnel can view sensitive client documents. Regular auditing of data access can help detect unusual patterns that might indicate exfiltration in progress.

Additionally, organizations should focus on data encryption both at rest and in transit to ensure that even if data is intercepted, it remains unreadable to unauthorized parties. Given the rise of double extortion, having a comprehensive incident response plan that specifically addresses data exfiltration is critical for managing both technical and reputational consequences.