The Law Offices of Michael C George listed on dragonforce leak site

• Ransomware group: dragonforce
• Country: United States
• Sector: Professional Services
• Announcement date: October 27, 2025

The Law Offices of Michael C George has been listed on the leak site of the threat group known as dragonforce. This announcement, published on October 27, 2025, indicates that the law firm has been targeted in a cyberattack, according to the claims made by the threat actor.

The claims made by dragonforce

The threat actor known as dragonforce claims to have targeted The Law Offices of Michael C George in a post published on October 27, 2025. The announcement alleges that data belonging to the firm has been compromised. While the announcement was made in late October, the group claims the attack itself took place on October 14, 2025.

Dragonforce is a threat group that emerged in 2023. The group has adopted a specific business model in which they provide infrastructure to various affiliates to carry out their operations. This model is common among modern ransomware operations, where a central group manages the technical tools and hosting, while affiliates perform the actual intrusions and data exfiltration.

Details regarding the alleged leaked data

Regarding the specific nature of the information involved in this incident, the group has not provided any details. No information or screenshots regarding the nature of the alleged leaked data have been provided by the threat actor.

Affected data types

• No specific data types were named in the listing.

The organization profile

The Law Offices of Michael C George is a law firm based in Florida. It provides legal representation and consulting services in areas such as personal injury, criminal law, automobile accidents, and medical malpractice.

Impact and assessment of the incident

This incident may pose a risk to the law firm regarding client confidentiality and sensitive legal documentation. If personal information is included in the alleged leak, legal processes under US state laws and relevant data protection regulations may be triggered. The alleged breach could increase the likelihood of clients being exposed to identity theft or targeted phishing attacks.

Furthermore, damage to the firm's professional reputation and disruption of operational processes may occur. Given the group's business model, it is possible that the data could be shared on other platforms or used in secondary extortion attempts in the future.

In the broader context of cybersecurity, such incidents highlight the risks faced by professional services. Ransomware groups often use a double extortion model, where they not only encrypt systems to disrupt operations but also steal sensitive data to threaten the victim with public disclosure. This pressure is designed to force organizations into paying ransoms to prevent the release of confidential information.

For organizations operating in the professional services sector, maintaining robust defensive postures is critical. This typically involves implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training to prevent initial access through phishing. As threat actors continue to target sensitive legal documentation, the potential for secondary extortion and identity theft remains a significant concern for firms and their clients alike.