Doak Shirreff Lawyers Listed by direwolf Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target professional-services firms that hold concentrated stores of confidential client material, using double-extortion tactics that combine encryption with data theft and public leak-site pressure. Against that backdrop, Doak Shirreff Lawyers, a full-service firm in Kelowna, British Columbia, was listed by the ransomware group known as direwolf on or around 8 July 2025. Public detail remains limited: the number of people affected is unknown, and the only confirmed description of the material is that internal files were allegedly exfiltrated in a ransomware attack. The listing itself is a claim by the group and has not been independently verified in the available record.

For clients, staff and counterparties of a law firm, any such claim raises immediate questions about the confidentiality of legal files, personal identifiers and commercial information. This article sets out only what the public record states, places the claim in the context of how direwolf typically operates, and outlines practical steps for anyone who may be concerned.

Inside the incident

According to the reported information, Doak Shirreff Lawyers was listed by the direwolf ransomware group on 8 July 2025. The listing asserts that internal files were exfiltrated during a ransomware attack. No further technical detail—such as the initial access vector, the date of intrusion, the volume of data taken, or whether systems were encrypted—has been disclosed in the available facts. The number of individuals whose information may have been involved is stated as unknown. Because the sole public source is the group’s own leak-site claim, the incident remains an unverified assertion rather than a confirmed, independently audited disclosure.

Law firms are frequent targets precisely because their networks routinely contain privileged correspondence, contracts, identity documents and financial records. In the absence of an official statement from the firm or a regulator claiming the scope, the concrete facts stop at the listing date, the organisation named, and the description of “internal files exfiltrated in ransomware attack.”

Inside direwolf

Direwolf is a ransomware operation that follows the now-standard double-extortion model: after gaining access to a network, operators encrypt systems and simultaneously exfiltrate data, then threaten to publish the stolen material on a dedicated leak site if a ransom is not paid. Like other groups in this ecosystem, direwolf typically posts victim names, sometimes with sample files or file counts, to increase pressure. Public reporting on the group has documented a pattern of opportunistic targeting across multiple sectors rather than exclusive focus on any single industry. The group’s claims are self-published and should be treated as unverified until corroborated by the victim organisation, law enforcement or independent forensic analysis. In this case, the facts record only that Doak Shirreff Lawyers appeared on the listing; no additional statements attributed to direwolf about this specific firm are provided.

Who is Doak Shirreff Lawyers?

Doak Shirreff Kelowna Lawyers is described as a full-service law firm based in Kelowna, British Columbia. Full-service firms of this type typically advise clients on corporate and commercial matters, real estate, litigation, wills and estates, family law and related areas. In the ordinary course of practice they hold client identity documents, financial records, privileged legal advice, contracts, medical or personal information relevant to disputes, and internal administrative files. Because legal professional privilege and client confidentiality are central to the practice of law, any unauthorised access to a firm’s systems carries heightened consequences for the people whose matters are handled there. The firm’s location in a regional centre does not reduce the sensitivity of the data; it simply means the affected client base is likely concentrated in British Columbia and western Canada.

What was likely exposed

The only data type named in the available facts is “internal files exfiltrated in ransomware attack.” Exact contents, file counts and whether any particular client matters were included remain undisclosed and unconfirmed. Organisations of this kind ordinarily maintain:

• Client identification and contact details
• Privileged correspondence and legal opinions
• Contracts, deeds and financial records
• Internal administrative and personnel files

None of the above can be asserted as confirmed exposures in this incident. Readers should treat any specific claim about their own information as unproven until the firm or an official notification provides further detail.

Why it matters

For individuals, the practical risks of a law-firm data exposure include identity theft, targeted phishing that references real legal matters, and the potential misuse of sensitive personal or commercial information. Even when the precise files remain unknown, the mere possibility that privileged material has left the firm’s control can create lasting uncertainty for clients. For the organisation, a ransomware listing can disrupt operations, trigger regulatory notification duties under Canadian privacy law, and damage the trust that underpins solicitor-client relationships. Because the scale is unknown, the firm and any affected parties must proceed on the assumption that internal material may have been copied, while recognising that the claim itself has not been independently verified.

Were you affected?

If you are a current or former client, employee or counterparty of Doak Shirreff Lawyers, monitor communications from the firm for any formal notification. Review bank and credit statements for unusual activity, enable multi-factor authentication on email and financial accounts, and treat unsolicited messages that reference legal matters with caution. Public detail on this incident is limited; the number of people affected and the precise contents of the exfiltrated files have not been disclosed. As a further practical step, you can run a free exposure scan of your email address to check whether your information has already appeared in other known breach datasets. That check does not confirm or rule out involvement in this specific incident, but it can surface earlier exposures that require attention.

AICompiled with AI assistance from public sources and published under our editorial standards.