Best Attorneys Listed by incransom Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On January 2, 2026, the ransomware group incransom listed Best Attorneys on its leak site. The organization, identified in public records as Eisenberg Lowrance Lundell Lofgren, is a law firm based in South Jordan, Utah. The number of people affected has not been disclosed, and the only confirmed detail is that internal files were allegedly exfiltrated during a ransomware attack. This listing adds to the pattern of ransomware operators targeting professional services firms that hold client records. Public information on the incident remains limited to the group’s claim and the reported date.

Inside the incident

Reporting on the event is confined to the January 2, 2026 listing by incransom. No information has been released on the date of the intrusion, the volume of data taken, or the specific tactics used to gain access. The sole technical detail provided is that internal files were allegedly exfiltrated as part of the ransomware operation.

Scale remains unknown. No statement from the firm or from law-enforcement agencies has confirmed or refuted the group’s claim.

The group behind it: incransom

Incransom is a ransomware operator that maintains a public leak site where it lists organizations it claims to have compromised. The group’s typical activity involves encrypting systems and removing copies of files, then using the threat of disclosure to press for payment. Such groups have previously targeted a range of sectors, including professional services, and have published data when negotiations failed.

The listing of Best Attorneys constitutes the group’s assertion that it obtained material from the firm. No independent confirmation of that assertion has been made public.

Best Attorneys and its sector

Best Attorneys operates as Eisenberg Lowrance Lundell Lofgren, a contingency-fee practice located in South Jordan, Utah. The firm handles personal injury, immigration, and criminal defense matters. Law firms of this type routinely collect and store client personal information, case documents, medical records, and financial details necessary for representation.

Attacks on legal practices are consequential because the data they maintain is often subject to attorney-client privilege and contains material that cannot easily be altered, such as immigration histories or medical documentation tied to litigation.

What data was at risk

The only information released states that internal files were exfiltrated. No inventory of specific record types or file counts has been published. Organizations in this sector commonly retain client names, contact details, identification documents, medical and financial information, and correspondence related to ongoing cases. The precise contents of the exfiltrated material have not been confirmed.

What's at stake

For individuals whose records were among the internal files, exposure can lead to misuse of personal identifiers, complications in immigration or legal proceedings, and long-term privacy erosion. For the firm, the incident carries potential regulatory scrutiny under professional-conduct rules and possible civil claims from clients whose information was removed without authorization.

Operational effects may include extended downtime while systems are restored and costs associated with forensic review and client notification, though none of these outcomes have been quantified in available reporting.

If your data was in this claimed breach

Individuals concerned about possible exposure should monitor their financial accounts and credit reports for unusual activity. Changing passwords for any accounts linked to the firm and enabling multi-factor authentication where available are standard first measures. Because the exact records involved are not public, a targeted notification from the firm remains the most direct source of information.

Readers can run a free exposure scan of their email address against known breach data sets to check for prior appearances of their information in other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.