Brown & Brown PC Listed by dragonforce Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to treat professional-services firms as high-value targets, combining data theft with public pressure on leak sites. In that landscape, the June 2025 listing of Brown & Brown PC by the group known as dragonforce fits a familiar pattern: an organisation that holds sensitive client material appears on a criminal forum, with limited independent confirmation of scale or method.

Public reporting states that Brown & Brown PC was listed by the dragonforce ransomware group on or around 23 June 2025. The group claims internal files were exfiltrated in a ransomware attack and that the material includes data of several thousand customers. The number of people affected remains unknown, and many operational details have not been disclosed. For clients and staff of a law firm, any such claim raises concrete questions about confidentiality and next steps.

Inside the incident

According to available reporting, Brown & Brown PC appeared on the dragonforce leak site in late June 2025. The listing characterises the event as a ransomware attack in which internal files were taken. The same reporting notes that the material is said to include data of several thousand customers. No confirmed figure for total individuals affected has been published, and the precise date of initial access, the encryption status of systems, or any ransom demand have not been made public.

Independent verification of the volume or exact contents of the claimed files is not available in the public record. Organisations facing such listings sometimes confirm an incident later through regulatory notices or client letters; as of the reported date, those details remain limited. The core public fact is therefore the group’s claim of exfiltration of internal files, framed as part of a ransomware operation.

The group behind it: dragonforce

Dragonforce is a ransomware operation that has been active in public reporting since roughly 2023–2024. Like many contemporary groups, it is understood to operate a ransomware-as-a-service model, combining encryption of victim systems with data theft and the threat of publication on a dedicated leak site. The group has previously claimed attacks across multiple sectors and geographies, typically publicising victims after negotiations stall or as pressure tactics.

Its tactics, as documented in open-source analysis of other incidents, commonly include initial access through compromised credentials or vulnerable remote services, followed by lateral movement, data staging, and exfiltration before any encryption. The listing of Brown & Brown PC should be read as the group’s claim rather than an independently verified statement of compromise. No public statements attributed to dragonforce beyond the listing itself are recorded in the available facts for this specific case.

Who is Brown & Brown PC?

Brown & Brown, P.C. is a law firm that describes itself as offering comprehensive legal services with the personal attention of a general practitioner alongside specialised expertise required in complex legal environments. Firms of this type routinely handle client identities, case files, financial records, correspondence, and other privileged or confidential material. They also maintain internal operational documents, employee information, and billing data.

Because legal practices sit at the intersection of personal, commercial, and sometimes sensitive dispute-related information, a claimed breach carries weight beyond ordinary corporate data loss. Clients entrust such firms with material that can affect litigation strategy, personal privacy, and professional reputation. The firm’s own public description emphasises long-term client relationships, which underscores why any unauthorised access to its files is consequential for those individuals and entities.

What data was at risk

The public facts state that internal files were exfiltrated in a ransomware attack and that the material is said to include data of several thousand customers. Beyond that characterisation, the exact data types—whether client names, case documents, contact details, financial records, or other categories—have not been itemised in the available reporting. The number of people affected is listed as unknown.

Law firms of this kind typically hold privileged communications, identification documents, contracts, billing information, and employee records. Those categories are common across the sector, yet it would be inaccurate to assert that any specific field was confirmed present in this incident. The only named description remains “internal files” claimed to encompass data of several thousand customers. Readers should treat further detail as unconfirmed until the firm or regulators provide it.

Why it matters

For individuals whose information may have been among the claimed files, the practical risks include targeted phishing, identity misuse, or exposure of private legal matters. Even without confirmed full contents, the mere assertion that customer data left the firm’s control can create anxiety and require defensive steps. For the organisation itself, a public ransomware listing can damage client trust, trigger regulatory notification duties, and generate legal exposure under professional-conduct and data-protection rules.

Because the scale remains unknown and the precise data types unconfirmed, the impact cannot be quantified with certainty. Still, the combination of a ransomware claim and a professional-services victim is enough to warrant attention from anyone who has been a client or employee. Calm verification and monitoring are more useful than speculation about motives or total harm.

If your data was in this claimed breach

If you have been a client or employee of Brown & Brown PC, treat the listing as a signal to increase vigilance rather than as proof that your specific records were taken. Monitor financial and email accounts for unusual activity, enable multi-factor authentication where available, and be wary of unsolicited messages that reference legal matters or request personal details. Consider placing fraud alerts with credit bureaus if you believe sensitive identifiers may have been involved. You can also run a free exposure scan of your email address to check whether it has already appeared in known breach datasets. Official updates from the firm or relevant authorities remain the most reliable source of further detail; until those appear, the public record is limited to the dragonforce claim of internal-file exfiltration reported on 23 June 2025.

AICompiled with AI assistance from public sources and published under our editorial standards.