State Bar of Texas (www.texasbar.com) Listed by incransom Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target professional regulators and public-sector bodies, treating the sensitive records they hold as leverage. Against that backdrop, the State Bar of Texas appeared on a leak site operated by the incransom ransomware group in mid-February 2025, an event that has drawn attention because of the organisation’s role in licensing and overseeing Texas attorneys.

Public reporting so far is limited to the group’s claim that it exfiltrated internal files. No independent confirmation of the intrusion’s scope, the precise data taken, or the number of people affected has been released. The listing itself therefore remains an unverified assertion by the threat actor.

What happened

On or about 12 February 2025, the incransom ransomware group listed the State Bar of Texas (www.texasbar.com) among its claimed victims. According to the group’s own statement, internal files were exfiltrated during a ransomware attack. The number of people affected is unknown, and no further technical details—such as the initial access vector, the duration of the intrusion, or whether systems were encrypted—have been disclosed by either the organisation or the attackers. The listing constitutes a claim by the group; it has not been independently verified in the available public record.

Who is incransom?

Incransom is a ransomware operation that follows the now-common double-extortion model: after gaining access to a network, operators steal data and then threaten to publish it unless a ransom is paid. Like other groups in this category, incransom maintains a dark-web leak site where it posts victim names and, in some cases, sample files to increase pressure. The group’s public activity has included listings of organisations across multiple sectors; its tactics typically involve phishing, exploitation of remote-access services, or compromised credentials, followed by lateral movement and data staging. No specific statements by incransom about the State Bar of Texas beyond the listing itself are part of the public facts of this incident.

Who is State Bar of Texas (www.texasbar.com)?

The State Bar of Texas, founded in 1939 and headquartered in Austin, is the agency that assists the Texas Supreme Court in regulating attorneys licensed to practise law in the state. It handles licensing, continuing legal education, disciplinary matters, and related administrative functions. Organisations of this type routinely maintain databases of attorney personal and professional information, complaint files, financial records related to dues and fees, and internal correspondence. Because the Bar sits at the centre of the state’s legal profession, any compromise of its systems carries implications for both the regulated community and the public that relies on the integrity of that regulation.

What was likely exposed

The only data category named in the available facts is “internal files exfiltrated in ransomware attack.” No further breakdown—such as whether the files included membership rosters, disciplinary records, financial data, or employee information—has been provided. In the absence of Reported Details, it is possible only to note that a professional regulatory body of this kind typically holds personally identifiable information on licensed attorneys, complaint and investigation materials, and internal administrative documents. The exact contents of any material taken remain unconfirmed.

What's at stake

For individuals whose information may have been among the internal files, the principal risks are identity theft, targeted phishing, or the exposure of sensitive professional or personal details. Attorneys could face reputational harm or further social-engineering attempts if disciplinary or contact data were involved. For the organisation itself, the incident raises questions of operational continuity, potential regulatory scrutiny, and the cost of investigation and remediation. Because the number of people affected is unknown and the precise data types are undisclosed, the full scale of these risks cannot yet be quantified. The mere fact of a ransomware listing can also erode public confidence in the security of professional oversight bodies.

Were you affected?

If you are a licensed Texas attorney, an employee of the State Bar, or someone who has interacted with the organisation’s systems, treat the possibility of exposure seriously until more information is released. Monitor financial and professional accounts for unusual activity, enable multi-factor authentication where available, and be alert to unexpected emails or calls that reference Bar-related matters. Readers can also run a free exposure scan of their email address to check whether their information has already appeared in known breach data sets. Official updates, if any, should be sought directly from the State Bar of Texas rather than from third-party claims.

AICompiled with AI assistance from public sources and published under our editorial standards.