The State Bar of Texas this week started sending notification letters to thousands of individuals to notify them of a data breach resulting from a February ransomware attack.
On February 12, the state bar association wrote in the notification letters, suspicious activity on its network prompted it to initiate response procedures and launch an investigation.
The association determined that a threat actor had access to its network between January 28 and February 9, and it stole certain files, including ones containing personal information.
The compromised information, the State Bar of Texas says, varies by individuals, and the copies of the notification letter that were submitted to Attorney General Offices have been redacted in this regard.
However, the association notified the Texas OAG that Social Security numbers, driver’s license numbers, government-issued ID numbers, financial information (such as credit card numbers and account numbers), medical information, and health insurance details were compromised in the attack.
The State Bar of Texas says it is not aware of “any actual or attempted fraudulent misuse” of the stolen information but it is providing the impacted individuals with 12/24 months of free identity theft and credit monitoring services.
The association has not shared details on the total number of impacted individuals, but its filings with the Texas, New Hampshire, and Massachusetts authorities reveal that over 2,700 people were affected.
The State Bar of Texas did not share information on the type of cyberattack it fell victim to, but the incident was claimed by the INC Ransom gang in late February, by adding the association to its Tor-Based leak site.
SecurityWeek has emailed the State Bar of Texas for additional information on the data breach and will update this article if a reply arrives.
With more than 100,000 active members, the State Bar of Texas is the second-largest bar association in the US. As an administrator of the legal system, it oversees ethical conduct for lawyers, licensing, and disciplinary actions.
“What’s particularly concerning here is the nature of the exposed data. Legal case documents and personally identifiable information (PII) can have far-reaching implications — not just in terms of privacy, but also in undermining legal processes and potentially jeopardizing ongoing litigation,” Exabeam senior director Steve Povolny said in an emailed statement.
Related: Hunters International Ransomware Gang Rebranding, Shifting Focus
Related: Ransomware Group Takes Credit for National Presto Industries Attack
Related: Critical Condition: Legacy Medical Devices Remain Easy Targets for Ransomware
Related: Ransomware Group Claims Attack on Virginia Attorney General’s Office
