Tapper Cuddy LLP listed on Storm ransomware leak site

• Ransomware group: Storm
• Country: Canada
• Sector: Professional Services
• Announcement date: August 14, 2026

The ransomware group known as Storm has listed the Canadian law firm Tapper Cuddy LLP on its leak site. The group claims to have successfully breached the organization and obtained access to its internal data, marking a significant incident for the professional services sector in Canada.

The claims made by the Storm group

According to the announcement made on the group's leak site, the incident involving Tapper Cuddy LLP was claimed to have occurred on August 11, 2026. The group has established a dedicated listing for the firm to showcase their alleged success in compromising the organization's systems.

While the group has officially posted a listing for the law firm, they have not yet uploaded a specific file list to their platform. At this stage, the group has provided 18 images as evidence to support their claim of having accessed the firm's environment. These images serve as the primary proof presented by the threat actors to substantiate their alleged breach.

Ransomware groups often utilize these leak sites as a method of double extortion. In such scenarios, attackers do not only encrypt an organization's data to disrupt operations but also threaten to release sensitive information publicly to pressure the victim into paying a ransom. This tactic is designed to maximize the psychological and reputational impact on the target organization.

Information regarding the alleged data breach

The specific nature and contents of the leaked data have not been disclosed through a formal file list provided by the attackers. Because no specific file list has been uploaded, the exact volume of data or the specific types of files stolen remain unknown at this time.

However, the 18 images provided by the Storm group as evidence suggest that the compromised data may include documents related to the firm's operations or legal matters. The presence of these images indicates that the attackers have captured visual evidence of the firm's internal files.

The listing names no specific data types in a structured list, leaving the full scope of the potential exposure unclear.

About Tapper Cuddy LLP

Tapper Cuddy LLP is a full-service law firm based in Manitoba, Canada. The firm has a long-standing history in the legal sector, boasting over 40 years of experience. They specialize in several key areas of law, including civil litigation, family law, and commercial law.

The firm provides legal representation across more than 20 specialized practice areas. Their services are tailored to meet the needs of both individual and corporate clients, making them a comprehensive provider within the professional services sector.

Risk assessment and industry implications

This incident may pose a significant risk due to the sensitive nature of the client information typically held by law firms. Because legal practices handle confidential communications, personal identifiers, and sensitive litigation details, they are high-value targets for cybercriminals. If the leaked data does indeed include confidential client information, it could potentially lead to identity theft and targeted phishing campaigns against the firm's clients.

Under Canada's PIPEDA regulations, the firm may face legal obligations regarding the protection of personal data. Such regulations require organizations to implement robust safeguards to protect the privacy of the individuals they serve. Failure to secure this data can result in significant regulatory scrutiny and legal consequences.

For organizations operating in the professional services sector, this incident highlights the necessity of proactive defense. Common defensive steps include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training for staff. Furthermore, if a breach is suspected, organizations may need to take immediate steps to notify affected clients and initiate necessary legal and compliance procedures to mitigate the impact of the exposure.