A ransomware group claims it stole roughly 2.5 million files from Pope County Title Company, reportedly including Social Security numbers, tax records, bank credentials, and legal case files. The company has not confirmed this breach. Affected individuals should monitor their credit reports and consider a credit freeze as a first step.
| Company | Pope County Title Company |
|---|---|
| Industry | Finance |
| Data Types Exposed | Social Security Numbers, Tax ID Numbers, W-2 and 1099 Tax Forms, Passport and Driver’s License Scans, Bank Account Numbers and Wire Instructions, Bank Portal Passwords, Personal Tax Returns, Medical Bills, Criminal Case Files |
| People Affected | Not Publicly Disclosed |
| Attack Method | Ransomware |
| Regulators Notified | Not Publicly Disclosed |
Were you affected by this breach?
You may be owed compensation.
Data breach victims can recover money for identity-theft losses, out-of-pocket costs, wasted time, and the ongoing risk of fraud — usually with no upfront cost, and no fee unless you win.
Check if you qualify — free reviewWhat Happened in the Pope County Title Company Data Breach?
A ransomware group has posted a claim that it breached Pope County Title Company, an Arkansas-based title agency that also operates under the names Johnson County Title, Carol Collins Law, Principle Escrow, and Principle Intermediary. The group says it accessed and copied an enormous volume of company files. According to the claim, roughly 2.5 million files totaling about 784 gigabytes were taken from the firm’s systems.
The posting describes the stolen material as including decades of county title records, daily closing documents, and internal business files. Because this is an extortion-group claim rather than a company statement, the exact timeline of the intrusion has not been publicly disclosed. The breach discovery date has also not been made public at this time.
As of now, Pope County Title Company has not publicly confirmed this incident. There is no indication yet of a forensic investigation, law enforcement involvement, or an official notification process tied to this specific claim. Readers should treat the details below as allegations made by the threat actor, not as verified facts from the company itself.
Who was affected?
Based on the claim, the people potentially affected include real-estate buyers and sellers, company employees, and clients of a related law practice. The attacker specifically references 1,202 buyers and sellers tied to 2025 closings, as well as fresh payroll records covering all staff members.
The exact number of individuals affected by this incident has not been publicly disclosed. However, because the claimed files span county registry records from 1983 through 2026, the population potentially touched by this incident could be large. This may include people who closed real-estate transactions years or even decades ago, not just recent clients.
In addition, the claim references criminal-case materials tied to a public defender’s law practice allegedly run by the same owner. If accurate, this would mean the affected population could extend beyond title-company clients to criminal defendants and their families. This adds an unusual layer of sensitivity to an already serious situation.
What Information Was Potentially Exposed?
The extortion group’s posting lists a wide range of data categories it claims to have obtained. Because this list comes from the attacker rather than a confirmed company disclosure, it should be read as an unverified claim. Still, the specificity of the described records warrants caution for anyone who has done business with this company.
- Social Security numbers and Tax ID numbers
- W-2 and 1099 tax forms with wages and addresses
- Scanned passports, driver’s licenses, and Social Security cards
- Bank portal passwords and security answers
- Bank account numbers and wire transfer instructions
- Escrow ledgers and closing documents
- Personal tax returns, including joint filings with spousal Social Security numbers
- Medical bills and investment account details
- Social Security retirement application records
- Criminal case files, including phone extraction data tied to defendants
- Divorce, guardianship, and estate legal case files
If these claims hold up, the risk to affected individuals would be significant. Social Security numbers combined with tax records and government ID scans give criminals nearly everything needed to open new credit accounts, file fraudulent tax returns, or impersonate victims with government agencies. This is especially concerning because the data reportedly spans both recent transactions and decades-old county records.
Beyond identity theft, the presence of bank portal passwords and wire instructions raises the risk of direct financial theft. Real-estate transactions are already a common target for wire fraud schemes. As a result, anyone who has closed a transaction through this company should watch closely for unusual account activity or unexpected contact regarding a transaction.
What is the company doing?
Pope County Title Company has not issued any public statement addressing this claim as of this writing. Because no confirmation has been made, it is not possible to describe what investigation, containment, or remediation steps, if any, are underway.
There is also no publicly disclosed information about customer notifications, credit monitoring offers, or law enforcement coordination tied to this specific incident. If the company does issue a statement or begin notifying affected individuals, that information will typically appear in official breach notification filings or direct correspondence to those impacted. Anyone who has worked with this company should watch their mail and email for official notices in the coming weeks.
What Should Affected Individuals Do?
Monitor Your Credit Reports
Anyone who has used this title company for a real-estate closing or legal matter should check their credit reports regularly. You can request free reports from all three major credit bureaus through AnnualCreditReport.com.
Look specifically for accounts you did not open, unfamiliar inquiries, or unexpected changes to your address. Because the claimed data includes tax and financial records, early detection of misuse is critical. Consider checking your reports every few weeks rather than waiting for a routine annual check.
Consider a Credit Freeze or Fraud Alert
Given the claim that Social Security numbers and Tax ID numbers were taken, a credit freeze is a strong protective step. A freeze blocks lenders from accessing your credit file, which makes it much harder for someone to open new accounts in your name.
Alternatively, a fraud alert requires creditors to verify your identity before extending credit. Both options are free to set up with each credit bureau. Because this incident reportedly involves tax documents and government ID scans, affected individuals should treat this step as a priority rather than an afterthought.
Watch for Phishing and Impersonation Attempts
Criminals often use stolen personal details to craft convincing phishing emails or phone calls. For example, a scammer might reference a real closing date or property address to appear legitimate.
Therefore, be cautious of unexpected messages asking you to verify account details, click links, or send money. If you receive communication claiming to be from a title company, bank, or law office, contact the organization directly using a known phone number instead of responding to the message itself.
Protect Against Tax Fraud
Because the claim specifically mentions tax returns and Tax ID numbers, affected individuals should also guard against tax-related identity theft. This can include someone filing a fraudulent return in your name to claim a refund.
Consider requesting an Identity Protection PIN from the IRS, which adds a layer of verification to any tax return filed under your Social Security number. In addition, file your taxes as early as possible each year to reduce the window of opportunity for fraud.
Consult a Data Breach Attorney
If you believe your information was included in this incident, it may be worth speaking with an attorney who handles data breach cases. Many offer free initial consultations to review your situation.
An attorney can help you understand whether you may be eligible for compensation and what documentation to preserve. Because this incident reportedly involves highly sensitive financial and legal records, professional guidance can help you respond effectively.
Get a Free Case Review
Tell us how this breach affected you. A data breach attorney will review your situation at no cost and with no obligation — it takes about two minutes.