Centennial Law Group LLP Listed by medusa Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target professional services firms, using data theft and public pressure as leverage. Law practices, which routinely handle confidential client matters, sit squarely in that landscape. In early March 2024, Centennial Law Group LLP appeared on a listing associated with the medusa ransomware group, which claimed the firm had been hit and that internal files had been taken.

Public detail remains limited. What is known is that the group listed the firm, that the incident involved ransomware and claimed exfiltration of internal files, and that the number of people affected has not been disclosed. For clients and others who deal with the firm, the listing raises clear questions about what information may have been exposed and what practical steps to take next.

Breaking down the breach

According to available reporting, Centennial Law Group LLP was listed by the medusa ransomware group on or around March 03, 2024. The listing describes a ransomware attack in which internal files were allegedly exfiltrated. No confirmed figure has been published for the number of people affected, and public sources do not detail the precise method of initial access, the duration of any intrusion, or the full scope of systems involved.

The firm is described as a law practice serving private and corporate clients, with a corporate office at 25 Main St W Ste 1702, Hamilton, Ontario, L8P 1H1, Canada, and a staff of 17. Beyond the group’s claim of file exfiltration and the ransomware framing, further technical and operational specifics of this incident have not been made public. The listing itself should be treated as an unverified claim by the threat actor unless independently confirmed by the organisation or regulators.

Inside medusa

Medusa is a ransomware operation that has been active in the public eye for some time. Like many contemporary groups, it is associated with a double-extortion model: encrypting systems while also stealing data and threatening to publish it on a dedicated leak site if demands are not met. The group typically posts victim names, sometimes with sample files or descriptions of stolen material, to increase pressure.

Public reporting on medusa has linked it to attacks across multiple sectors, including professional services. Its operators have been observed using common ransomware tactics such as exploiting remote access weaknesses, deploying malware after initial compromise, and maintaining leak infrastructure to advertise claims. None of that background states the accuracy of any specific claim about Centennial Law Group LLP; it only places the listing in the context of how the group is known to operate. For this incident, the public record consists of the listing and the statement that internal files were allegedly exfiltrated in a ransomware attack.

Centennial Law Group LLP and its sector

Centennial Law Group LLP is a law firm that provides legal services to both private individuals and corporate clients. Its office is in Hamilton, Ontario, and it employs a relatively small team of 17 people. Law firms of this kind typically manage case files, correspondence, contracts, identity and contact details of clients, billing records, and other materials that are sensitive by nature.

A breach involving a legal practice is consequential because the information held is often confidential, sometimes privileged, and frequently includes personal data that could be misused if it falls into the wrong hands. Even a small firm can hold records spanning years of client relationships. When a ransomware group claims to have taken internal files, the concern is not only operational disruption but also the potential exposure of that material. Public reporting does not establish negligence or fault on the firm’s part; it records that the firm was listed and that internal files were said to have been exfiltrated.

What data was at risk

The facts state that internal files were exfiltrated in a ransomware attack. No further breakdown of file types, document categories, or specific data elements has been disclosed publicly. The number of people whose information may have been involved is unknown.

Organisations of this kind commonly hold client names and contact details, matter files, legal correspondence, contracts, financial and billing information, and related internal records. Whether any of those categories were among the files claimed to have been taken in this incident has not been confirmed. Exact contents remain unconfirmed; readers should treat any assumption about particular documents or personal data fields as speculative until the firm or an official notice provides more detail.

The real-world impact

For individuals and organisations that have dealt with Centennial Law Group LLP, the primary risks are those that follow from the possible exposure of confidential legal and personal information. That can include unwanted contact, attempts at fraud or social engineering that reference real case details, and longer-term privacy concerns if sensitive records circulate. Because the volume and exact nature of the data are undisclosed, the scale of those risks cannot be quantified from public sources alone.

For the firm itself, a ransomware incident typically brings operational disruption, the cost of investigation and recovery, and the need to communicate with clients and, where required, regulators. Reputational and professional obligations around client confidentiality add weight. None of this establishes that particular outcomes have already occurred; it describes the concrete categories of harm that such incidents commonly create when internal files are claimed to have been taken.

Were you affected?

If you are a current or former client, or if you have shared personal or business information with Centennial Law Group LLP, treat the listing as a signal to stay alert. Monitor accounts and correspondence for unusual activity that appears to reference your dealings with the firm. Consider placing fraud alerts with credit bureaus where appropriate, and be cautious of unsolicited messages that ask for money, credentials, or further personal details. If the firm issues formal notices, follow the guidance they provide.

You can also run a free exposure scan of your email address to check whether that address has appeared in known breach data sets. That step does not prove or disprove involvement in this specific incident, but it can help you see whether your information has already surfaced elsewhere and decide what further monitoring or password changes are warranted.

AICompiled with AI assistance from public sources and published under our editorial standards.