Texas State Bar hit by possible ransomware attack, warns of data breach

• The State Bar of Texas is warning members about a data breach
• It is offering free credit and identity theft monitoring
• INC ransomware claimed responsibility for the attack

The State Bar of Texas, the official regulatory authority for lawyers in the US state, has confirmed suffering a data breach that resulted in the theft of sensitive member data.

“On February 12, 2025, the State Bar of Texas identified suspicious activity on its network and moved quickly to secure its environment,” a data breach notification letter sent to affected individuals reads.”Through the investigation, we determined that there was unauthorized access to our network between January 28, 2025 and February 9, 2025.”

The Texas State Bar is responsible for licensing, ethics enforcement, and professional development. Its members are mostly licensed attorneys, and it also provides legal resources for the public and supports the legal profession through education and advocacy.

Monitor your credit score with TransUnion starting at $29.95/month

TransUnion is a credit monitoring service that helps you stay on top of your financial health. With real-time alerts, credit score tracking, and identity theft protection, it ensures you never miss important changes. You'll benefit from a customizable online interface with clear insights into your credit profile. Businesses also benefit from TransUnion’s advanced risk assessment tools.

Preferred partner (What does this mean?)

View Deal

INC ransomware

While the organization did not detail the type of information stolen, or the identity of the attackers, ransomware operators called INC ransomware claimed responsibility for the breach. In fact, the group already leaked samples of the data on the dark web, which include full member names and some legal case documents.

While the authenticity of the data is yet to be determined, the State Bar of Texas has already offered free credit and identity theft monitoring service through Experian, until July 31 2025.

Potentially affected individuals are also recommended activating a credit freeze, or placing a fraud alert on their credit files to make sure the attack does not escalate further.

If the organization is added to a leak site, and samples are available to download, then it’s safe to assume that the negotiations between the attackers and the victim are ongoing.

If the archives get removed, then the organization likely paid the ransom demand. If the entire data gets put up for sale (or dumped), then the negotiations most likely broke down.

Law enforcement agencies advise against paying the ransom demand.

Via BleepingComputer

You might also like

• Ivanti warns another critical security flaw is being attacked
• We've rounded up the best password managers
• Take a look at our guide to the best authenticator app