Nicholson y Cano Abogados Listed by dragonforce Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On July 13, 2026, the ransomware group dragonforce listed Nicholson y Cano Abogados on its leak site. The listing states that internal files were exfiltrated from the firm in a ransomware attack. No confirmed count of affected individuals or further technical details has been made public. The incident adds to a pattern of targeted operations against professional services firms that hold confidential records for clients across multiple industries.

Breaking down the breach

Public information on the incident remains limited to the July 13, 2026 listing. The group claims internal files were taken, yet no independent confirmation of the volume, file categories, or encryption of systems has been released. The number of people whose information may be involved is reported as unknown. No ransom demand figure, payment status, or restoration timeline appears in available records.

Who is dragonforce?

Dragonforce is a ransomware operator that maintains a leak site to publish names of claimed victims and, in some cases, sample data. Groups of this type typically gain initial access through phishing, credential compromise, or unpatched remote services, then move laterally to locate and copy files before deploying encryption. Their public listings serve as pressure on targeted organisations. Prior activity attributed to the group has focused on entities in finance, manufacturing, and professional services, though each claim requires separate verification.

Nicholson y Cano Abogados and its sector

Nicholson y Cano Abogados is a full-service law firm based in Argentina, founded in 1976. It employs 29 partners and more than 150 lawyers and maintains 20 practice areas that serve both domestic and international clients. Law firms in this category routinely receive, generate, and store contracts, due-diligence materials, regulatory filings, and correspondence that contain non-public commercial and personal information. A breach at such an organisation can therefore expose data belonging to many third parties beyond the firm itself.

The information in question

The only detail released states that internal files were exfiltrated. The precise categories, file counts, or time periods covered by those files have not been disclosed. Organisations of this type commonly hold client identities, financial arrangements, litigation strategy documents, and personal data collected during legal matters. Without an official notification or forensic summary, the exact contents remain unconfirmed.

What's at stake

Exposure of internal legal files can affect the confidentiality of ongoing matters and the privacy of individuals or companies named in those records. Clients may face secondary risks such as targeted follow-on scams or reputational harm if their information later appears in public or underground channels. For the firm, the incident creates obligations under Argentine data-protection rules and may require notification to clients and regulators once the scope is clarified. No evidence of immediate misuse has been reported to date.

Were you affected?

Individuals or organisations that have engaged Nicholson y Cano Abogados should monitor official statements from the firm and any regulatory notices that may follow. Practical first steps include reviewing recent account activity for unusual access, enabling or strengthening multi-factor authentication on email and financial accounts, and watching for unsolicited communications that reference the firm. Readers can also run a free exposure scan of their email address against known breach data sets to check whether their information has appeared in previously published incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.