The Professional Liability Fund Listed by medusa Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On February 26, 2024, The Professional Liability Fund, the mandatory professional negligence insurer for lawyers in Oregon, was listed by the medusa ransomware group as a victim of a ransomware attack in which internal files were claimed to have been exfiltrated. Public reporting so far provides no confirmed figure for the number of people affected, and the precise contents of the files remain undisclosed beyond the general description of internal material taken during the incident. For an organisation that underwrites primary coverage for more than 7,000 Oregon attorneys and holds related operational and claims data, the listing raises clear questions about what may have left its systems and who could be exposed as a result.

What is known rests on the group's own leak-site claim and the limited public summary of the organisation itself. No independent confirmation of the full scope, method, or timeline has been released in the available record, so the picture remains incomplete. That incompleteness itself matters: people whose information may sit inside a professional-liability insurer's files need a clear, unvarnished account of what has been stated and what has not.

Inside the incident

According to the available facts, The Professional Liability Fund was listed by medusa on or around February 26, 2024, with the assertion that internal files had been exfiltrated in a ransomware attack. No public detail has been provided on the initial access vector, the duration of any intrusion, whether encryption was also deployed, or the volume of data taken. The number of people affected is listed as unknown. The only data description given is “internal files exfiltrated in ransomware attack.” No file counts, sample documents, ransom demand, or confirmation of payment or non-payment appear in the record. In short, the incident is known primarily through the group's listing and the bare statement that internal material left the organisation; everything else remains undisclosed.

Inside medusa

Medusa is a ransomware operation that has operated in the public eye for several years, typically employing a double-extortion model: systems are encrypted and data is copied out, after which the group threatens to publish the stolen material on a dedicated leak site if payment is not made. Like other contemporary ransomware crews, medusa has listed a range of corporate, professional-services, and public-sector victims, using the pressure of public exposure to increase leverage. The group's leak-site postings are claims made by the actors themselves; they are not independent verification that every asserted detail is accurate or that every listed organisation has in fact suffered the full extent of compromise described. In this case the facts record only that The Professional Liability Fund was listed and that internal files were said to have been exfiltrated; no further statements attributed specifically to medusa about this victim appear in the given record.

Who is The Professional Liability Fund?

The Professional Liability Fund was established in 1977 under Oregon state law (ORS 9.080) with the approval of Oregon State Bar members and began operations on July 1, 1978. It is the mandatory provider of primary negligence insurance for lawyers in Oregon—the only U.S. state in which such coverage is compulsory—and covers more than 7,000 people. Its corporate office is located at 16037 SW Upper Boones Ferry Rd Ste 300, Portland, Oregon, 97224, and it employs 68 people. As a professional-liability insurer for the legal profession, the Fund sits at the intersection of insurance underwriting, claims handling, and the confidential practice of law. Organisations of this type routinely maintain policyholder records, claims files, correspondence with attorneys and clients, financial and actuarial data, and internal administrative documents. A breach affecting such an entity therefore carries consequences that extend beyond ordinary corporate data loss: it can touch the professional and personal information of lawyers and, potentially, the matters those lawyers handle for their clients.

What was likely exposed

The facts state only that internal files were exfiltrated. No inventory of specific data categories—names, Social Security numbers, claim details, financial records, or otherwise—has been publicly confirmed. Organisations that provide professional-liability coverage typically hold policy applications and renewals, claims histories, correspondence, billing and payment information, and internal operational files. Because the exact contents remain unconfirmed, it is not possible to state as fact which of these categories, if any, were among the material taken. Readers should treat any more granular description as speculative until official disclosure or independent verification appears.

What's at stake

For individuals whose information may have been present, the concrete risks include identity theft, targeted phishing or social-engineering attempts that leverage knowledge of legal or insurance matters, and the possibility that sensitive professional or personal details could be misused. For the organisation itself, the stakes include regulatory scrutiny, potential notification obligations, reputational harm among the Oregon bar, and the operational cost of investigation and remediation. Because the Fund is the sole mandatory primary carrier for Oregon lawyers, any disruption or loss of confidence can affect a large share of the state's legal profession. None of these outcomes is guaranteed; they are the ordinary, documented consequences that follow when internal files of an insurer leave its control. The absence of a confirmed headcount of affected people simply means the scale of individual impact cannot yet be quantified.

If your data was in this claimed breach

If you are an Oregon attorney, a former claimant, an employee, or anyone else who has dealt with The Professional Liability Fund, treat the listing as a reason to take basic protective steps. Monitor financial and credit accounts for unusual activity, enable multi-factor authentication on email and other critical services, and be alert for unsolicited messages that reference legal or insurance matters. Consider placing a fraud alert or credit freeze with the major credit bureaus if you believe sensitive identifiers may have been involved. Because the precise data set remains unconfirmed, these measures are precautionary rather than a response to a verified personal exposure. You can also run a free exposure scan of your email address to check whether that address has already appeared in known breach data sets; such a scan does not prove or disprove involvement in this specific incident, but it can surface other exposures that warrant attention. Official updates from the organisation or regulators, if and when they are issued, should be treated as the authoritative source for next steps.

AICompiled with AI assistance from public sources and published under our editorial standards.