Ishbia & Gagleard, P.C. Listed by Aurora Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

What the listing says

On or around August 31, 2026, the ransomware group known as Aurora listed Ishbia & Gagleard, P.C. on its leak site. That listing is an unverified claim by the group. As of writing, Ishbia & Gagleard, P.C. has not publicly confirmed that an incident occurred, that systems were accessed, or that any client or firm materials left its control. Public detail on timing of any alleged intrusion, method of access, ransom demand, or negotiation is limited; the available record does not establish those points.

According to the listing’s description, the group presents the firm as a boutique practice in Birmingham, Michigan, and asserts that material tied to client and matter work is involved. The listing’s own marketing language refers to large volumes of client and matter folders and to sensitive personal identifiers. Those assertions come from the claimant, not from a regulator, a court filing, or a company statement. How many people might be affected remains unknown in public reporting. Nothing in the public claim set confirms that files were actually copied, published, or sold.

Who is Aurora?

Aurora is a name used by a ransomware and extortion crew that has appeared in public threat reporting as an actor that encrypts systems and pressures victims by threatening to publish stolen data on a dedicated leak site. Like other groups in this category, it typically seeks payment in exchange for a decryptor and for withholding or deleting claimed copies of data. Public write-ups of such crews generally describe double-extortion patterns: disruption inside the victim environment paired with a leak-site countdown or sample dumps meant to increase pressure.

Listing a company on a leak site is a tactic, not proof. Groups sometimes recycle old material, inflate file counts, or name organisations before any independent verification. Readers should treat Aurora’s claims about Ishbia & Gagleard, P.C. as allegations from an extortion actor. The group’s reputation for operating ransomware campaigns does not, by itself, establish what happened in this specific case.

Who is Ishbia & Gagleard, P.C.?

Ishbia & Gagleard, P.C. is described in public materials associated with the listing as a boutique law firm in Birmingham, Michigan, founded in 1999 by Jeffrey A. Ishbia and Michael A. Gagleard. Firms of this type commonly advise high-net-worth individuals and closely held businesses. Practice areas often associated with such a shop include real estate, corporate work, estate planning, personal injury, medical malpractice, and commercial litigation.

Law firms sit on unusually sensitive collections of information because the work product is built around client confidences. Attorney-client privilege, litigation strategy, financial and family arrangements, medical and injury details, and commercial disputes all tend to flow through matter files, email, and document systems. A leak-site claim against a firm in this sector therefore raises practical concern for clients and counterparties even when the underlying incident is unconfirmed: people need a clear picture of what is alleged, what is not proven, and what prudent steps look like if their information were ever involved.

The information in question

Public facts do not include a confirmed inventory of taken data. The structured record marks data types as not disclosed in the sense of independent verification. Aurora’s listing text, however, claims that exposed material includes extensive client and matter folders and describes them in expansive terms—litigation strategy memos, settlement agreements, case assessments, deposition notes, correspondence with opposing counsel, and personal identifiers such as Social Security numbers for a stated set of individuals. That language is the group’s claim and marketing, not a verified catalogue.

If files of the kind law firms typically hold were ever copied, organisations in this sector often maintain matter chronologies, privileged legal analysis, contracts and settlement terms, identity documents, financial and estate records, medical or injury-related materials in relevant practice lines, and correspondence that can reveal litigation posture or private family and business affairs. None of that should be read as a finding that those categories left Ishbia & Gagleard, P.C. Exact contents, completeness, and whether any sample or full set was published remain unconfirmed in public sources.

What's at stake

For individuals and entities who have used a firm like this, the conditional risks are concrete. If privileged or sensitive matter files were obtained by criminals, opponents in litigation could in theory gain unfair insight into strategy or settlement posture; identity details could support fraud, tax-related scams, or account takeover; and highly personal estate, medical, or family information could be misused for harassment or further social engineering. High-net-worth and closely held business clients may also face secondary risk if commercial terms, ownership structures, or dispute histories became leverage for extortion against them rather than only against the firm.

For the organisation, a public leak-site listing creates reputational and operational pressure regardless of eventual proof: clients may ask hard questions, insurers and counsel may need to be engaged, and the firm may need to assess whether any obligation to notify exists under applicable law if a real incident is later established. A listing alone does not prove negligence, poor controls, or failed detection. It establishes only that a named extortion group chose to publish an accusation.

People affected counts are unknown. Without confirmation from the firm or a regulator, no one can say from the public record how many clients, employees, or third parties—if any—are implicated.

If your data was involved

If you are a current or former client, opposing party, or other person who shared sensitive information with Ishbia & Gagleard, P.C., treat the situation as conditional until the firm or an official source confirms facts. Reasonable first steps include contacting the firm through a verified channel to ask whether your matters are implicated and whether any notice process has begun; placing fraud alerts or credit freezes if identity data could be in scope; watching for phishing that references legal matters, settlements, or the firm’s name; and documenting any suspicious contact. Do not assume your files are public solely because a ransomware group posted a listing.

You can also run a free exposure scan of your email addresses to check whether your information has already surfaced in known breach datasets unrelated to this claim. That kind of check does not prove or disprove Aurora’s specific allegations, but it can help you see whether your addresses appear in other confirmed dumps and prioritise password changes and monitoring where needed.

Remain cautious about unsolicited messages that claim to hold your legal files or demand payment. Extortion actors and copycats often exploit news of leak-site posts. Rely on direct communication with the firm and, if appropriate, your own counsel rather than on criminal leak sites or anonymous intermediaries.

In short: Aurora has listed Ishbia & Gagleard, P.C. and described sensitive legal and identity material in its claim. The firm has not publicly confirmed the claim as of writing. People who may be connected to the practice should prepare for the possibility that privileged or personal data could be at risk, without treating the group’s marketing inventory as established fact.

Opening context for readers: when a ransomware crew names a law firm on a leak site, the immediate practical question for ordinary people is whether confidential legal files, identity numbers, or private correspondence could end up in criminal hands—and what to do while the claim remains unproven. That is the frame for this report: stakes first, verification second, and no conversion of an extortion listing into a settled breach narrative.

AICompiled with AI assistance from public sources and published under our editorial standards.