A ransomware group claims it stole client, legal, and confidential files from the Law Offices of Goldsmith & Hull A.P.C., a California law firm. The firm has not publicly confirmed this specific claim. The number of people affected and the exact data involved have not been disclosed. Anyone who has worked with the firm should monitor credit reports and watch for phishing attempts.
| Company | Law Offices of Goldsmith & Hull A.P.C. |
|---|---|
| Industry | Other Commercial |
| Data Types Exposed | Not Publicly Disclosed |
| People Affected | Not Publicly Disclosed |
| Attack Method | Ransomware |
| Regulators Notified | Vermont Attorney General |
Were you affected by this breach?
You may be owed compensation.
Data breach victims can recover money for identity-theft losses, out-of-pocket costs, wasted time, and the ongoing risk of fraud — usually with no upfront cost, and no fee unless you win.
Check if you qualify — free reviewWhat Happened in the Law Offices of Goldsmith & Hull A.P.C. Data Breach?
A ransomware group has claimed responsibility for an attack on the Law Offices of Goldsmith & Hull A.P.C., a California-based law firm. The claim appeared on the group’s dark web leak site, where it listed the firm among its alleged victims. As a result, the firm’s name is now tied to a reported data theft incident that has not been independently verified.
According to the claim, the attackers accessed files described as legal, personal, client-related, and confidential in nature. The group stated that it had not been paid and listed a data publication date in November 2026. Because this is an extortion-style posting, there is no confirmed timeline for when unauthorized access actually began.
The firm has not issued a public statement confirming or denying the incident. Therefore, important details, including how the alleged intrusion occurred and whether any forensic investigation has taken place, remain unknown. Readers should treat this as a reported claim rather than a confirmed breach until the firm or a regulator provides further information.
Who was affected?
Goldsmith & Hull describes itself as a firm handling personal injury, medical malpractice, insurance, collection, and subrogation matters. Given this practice focus, the people potentially affected could include current and former clients, opposing parties in litigation, and possibly employees of the firm. However, the source does not specify which groups were actually included in the data allegedly taken.
The exact number of individuals affected has not been publicly disclosed. The firm reportedly serves both individual clients and larger corporate clients, including companies seeking collection services. As a result, the potential scope of this incident could span a wide range of people across California and possibly other states where the firm’s clients reside.
What Information Was Potentially Exposed?
The ransomware group’s listing describes the stolen data only in broad terms. It labels the files as legal, personal, client-related, and confidential, without naming specific data categories such as Social Security numbers or financial account numbers. Because of this, the precise types of information involved have not been publicly disclosed.
In general, law firm case files can include a wide variety of sensitive material depending on the nature of each matter. However, this source does not confirm which specific categories apply here. For that reason, no bulleted list of exposed data types can be responsibly provided for this incident.
Even without confirmed specifics, the mere claim of a law firm breach raises real concern. Legal files often touch on deeply personal circumstances, including injuries, medical treatment, and financial disputes. If such records were genuinely accessed, the people named in them could face unwanted exposure of private details.
In addition, if any identifying information was included in the stolen files, affected individuals could face a higher risk of phishing attempts or impersonation. Because the claim remains unconfirmed, the realistic risk level cannot be precisely assessed at this time. Still, caution is warranted whenever a professional services firm reports or is linked to a data security incident.
What is the company doing?
Because this incident stems from a ransomware group’s own claim, there is no public evidence that Goldsmith & Hull has confirmed the attack. The firm has not released a statement describing an investigation, remediation steps, or a notification timeline tied to this specific claim. Consequently, this article cannot responsibly describe a company response to the ransomware group’s posting as established fact.
Separately, however, Law Offices of Goldsmith & Hull A.P.C. has been confirmed to have filed formal data breach notifications with the Vermont Attorney General on more than one occasion. These filings reflect the firm’s compliance with state breach notification requirements. It is not clear from available information whether those filings relate directly to the ransomware group’s claim described above or to a separate incident.
Affected individuals should watch for any official notification letters that may arrive by mail. In addition, monitoring the firm’s own communications and regulatory filings can help clarify the situation as more details emerge. Until further confirmation is available, the safest approach is to assume personal information could be at risk and to take proactive protective steps.
What Should Affected Individuals Do?
Monitor Your Credit Reports Closely
Anyone who has been a client of Goldsmith & Hull, or whose information may have passed through the firm during a legal matter, should check their credit reports regularly. You can request free reports from each of the three major credit bureaus. Reviewing these reports helps you catch new accounts or inquiries you did not authorize.
Because fraud can take time to surface, it helps to check reports periodically rather than just once. If you notice unfamiliar activity, report it immediately to the credit bureau and consider filing a police report. This creates a paper trail that can support any later identity theft claim.
Consider a Fraud Alert or Credit Freeze
Although the specific data types exposed in this claim have not been confirmed, placing a fraud alert on your credit file is a low-cost precaution. A fraud alert requires lenders to take extra verification steps before opening new credit in your name. This can slow down identity thieves even if your information was compromised elsewhere.
For stronger protection, you can also request a credit freeze, which restricts access to your credit file entirely. This step is especially useful if you suspect your personal details, such as your name combined with other identifiers, may have been included in the stolen files. Freezes are free and can be lifted temporarily whenever you need to apply for credit.
Stay Alert for Phishing and Impersonation Attempts
Because case files often include contact information, affected individuals should be cautious of unexpected emails, texts, or calls referencing legal matters. Scammers sometimes use breach claims as an opportunity to impersonate law firms or related parties. For example, you might receive a message asking you to confirm personal details or click a suspicious link.
Never provide sensitive information in response to an unsolicited message. Instead, verify any communication directly with the firm using contact details from its official website. This simple habit can prevent many common follow-up scams tied to data breach claims.
Keep Records and Watch for Official Notifications
If you believe you may have been a client or counterparty involved with Goldsmith & Hull, keep any correspondence you receive regarding this incident. Official notification letters, if sent, will typically explain what happened and what protections, if any, are being offered. Save these documents in case you need them later.
In addition, consider speaking with a data breach attorney for a free case evaluation if you receive a notification or suspect your information was involved. An attorney can help you understand your rights and whether you may be eligible to join a claim related to this incident. Acting early can help preserve your options if deadlines apply.
Get a Free Case Review
Tell us how this breach affected you. A data breach attorney will review your situation at no cost and with no obligation — it takes about two minutes.
More Information
View the public data breach notification listing from Vermont Attorney General