Texasbar cybersecurity incidents and threat signals

Feb 9, 2025Ransomware

Medium

State Bar of Texas suffers data breach by INC ransomware gang

Texas State Bar warns of data breach after INC ransomware claims attack The State Bar of Texas is warning it suffered a data breach after the INC ransomware gang claimed to have breached the organization and began leaking samples of stolen data. The State Bar of Texas is the second-largest bar association in the United States, with over 100,000 licensed attorneys. It regulates the legal profession in Texas by overseeing licensing, continuing legal education, ethical compliance, and disciplinary actions. In a notification letter sent to affected members, the organization states that it suffered a security breach between January 28 and February 9, 2025, but it was only discovered on February 12. The threat actors were able to steal information from the network, including full names and other data that is redacted in the public data breach notifications filed with Attorney Generals' offices. "Through the investigation, we determined that there was unauthorized access to our network between January 28, 2025 and February 9, 2025," reads the notice . "During this time, the unauthorized actor was able to take certain information from our network." The notice doesn't provide much information about the hacking group responsible for the breach, but the INC ransomware gang claimed an attack against the State Bar of Texas by adding the organization to its dark web extortion page on March 9, 2025. The threat actors have already leaked samples of allegedly stolen files, including legal case documents. BleepingComputer could not verify if the leaked data came from the organization's networks and if they were private or publicly available information. Our inquiry to the State Bar of Texas has so far gone unanswered. Recipients of the data breach notifications are offered free-of-charge credit and identity theft monitoring service coverage through Experian, given until July 31, 2025, to enroll using the enclosed activation code. Additionally, it is recommended that they consider activating a credit freeze or placing a fraud alert on their credit files to mitigate the risks that stem from the exposure. Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen. The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection. Ryuk ransomware member pleads guilty in the US, faces 15 years in prison FortiBleed credential-theft campaign linked to Lynx ransomware NAIC says public data stolen in ShinyHunters' PeopleSoft breach Texas govt data breach exposes over 3 million driver’s licenses DentaQuest data breach exposed info of 2.6 million accounts Texas State Bar Hit by Major Data Breach: The Verdict Is In Texas State Bar Overruled by Ransomware Gang – Counsel for Your Cybersecurity INC Ransom breached the second-largest bar association in the country and walked out with case documents and financial records. If it can happen to them, it can happen to any Houston firm holding client data. The Texas State Bar data breach is not a story about a giant target getting unlucky. It is a story about how a single intrusion at a professional legal body puts the personal data of attorneys, staff, and their clients on a dark web extortion page within weeks. The State Bar of Texas is the second-largest bar association in the United States, with more than 100,000 licensed attorneys. Between January 28 and February 9, 2025, attackers were inside its network exfiltrating data. The Bar did not discover the intrusion until February 12. CinchOps is a managed IT services provider based in Katy, Texas, serving small and mid-sized businesses across the Houston metro area, and we read breaches like this one so a Houston firm can act on the lesson instead of becoming the next headline. The Breach Ran for 12 Days Before Anyone Noticed A short intrusion window, a long list of stolen data types. The State Bar of Texas notified roughly 2,700 people that their data was taken in a breach that ran from January 28 to February 9, 2025, and was discovered on February 12. Notifications also went to a small number of out-of-state victims, including two in New Hampshire and eight in Massachusetts. The stolen data set is the kind that fuels identity theft for years. According to reporting by Comparitech, the compromised information included names, Social Security numbers, financial account details such as account and card numbers, driver's licenses and other government-issued IDs, medical information, and health insurance information. INC Ransom also leaked samples of what appear to be legal case documents, which is the part that should worry any firm holding privileged material. The dwell time was the real problem. Attackers had roughly 12 days inside the network before detection, and detection came 3 days after they stopped. That window is where the damage happens. The Bar has not confirmed the ransom outcome. The State Bar has not verified INC Ransom's claim, and the exact entry point and whether any ransom was paid remain undisclosed. Victims got Experian monitoring. The Bar offered free credit and identity-theft monitoring through Experian, with an enrollment deadline of July 31, 2025, plus advice to consider credit freezes and fraud alerts. INC Ransom Is a Ransomware Crew That Steals First and Encrypts Second The group behind the attack, by the numbers. INC Ransom is a ransomware gang that surfaced in July 2023 and hits healthcare, education, government, and legal targets. It runs double extortion: steal the data, threaten to publish it, then demand payment whether or not it also encrypts systems. The group's usual way in is spear phishing and exploiting known, unpatched vulnerabilities in edge software. Security researchers have tied INC Ransom activity to internet-facing weaknesses in products like Citrix, Fortinet, and remote-management tools. It listed the State Bar of Texas on its dark web extortion page in early 2025 and posted sample files to pressure a payment. For a small firm, the takeaway is direct: the entry points INC Ransom favors are the same ones a Houston business leaves exposed when patching slips and multi-factor authentication is optional.