Skip to content
Leak-site post naming Ishbia & Gagleard, P.C., captured by ThreatCluster

Ishbia & Gagleard, P.C.

aurora

Ransomware leak-site victim intelligence · EN

Data size
1.707 TB
Files
12
Views
22,909
Posted
Sep 6, 2026
Country
United States
Industry
legal services

Summary

Written by ThreatClusterfrom site fields, file listing, victim profile, leak post, screenshot

Threat actors claim they have stolen 12 files from Ishbia & Gagleard, P.C., a Birmingham, Michigan law firm. They state the data types include attorney-client privilege materials, Social Security Numbers, Protected Health Information, tax returns, email archives, and personal legal matters of Mat Ishbia. The leak post is listed on the group’s site and includes sample filenames.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

Victim profile

Founded
1999
Domains
iglawfirm.com
Platforms
Office 365
People named
Jeffrey A. Ishbia Michael A. Gagleard Mat Ishbia

What was taken

Ishbia & Gagleard, P.C. — a boutique law firm in Birmingham, Michigan, founded in 1999 by Jeffrey A. Ishbia and Michael A. Gagleard. The firm practises real estate, corporate, estate planning, personal injury, medical malpractice, and commercial litigation for high-net-worth individuals.

Data categories
360+ client/matter foldersFull Social Security Numbers for 25+ identified individualsProtected Health Information100+ client tax returns spanning 2003–202411 email archive files (PST/OST)Personal legal matters of Mat Ishbia
Leak site tags
law
File types seen
7z × 1csv × 1pdf × 1wpd × 1docx × 8
Sample files (12)
Cozy Password is 382346015.wpd
IGLAWFIRM Domain Credentials - JAI.docx
IG - Office365 users_8_9_2023.csv
IGLAWFIRM Domain Credentials - MAG.docx
Beneficiary Addresses and SSNs.docx
Emma Loughead 2026-02-25.docx
ISHBIA GAGLEARD Summary of Network Access.docx
IGLAWFIRM Domain Credentials - SG.docx
Cantin-Plaintiff's Confidential Mediation Memorandum.pdf
IGLAWFIRM Domain Credentials - IK.docx
Gagleard (Aaron)-Plaintiff's Confidential Mediation Brief.docx
tree.7z

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

Notes
Files — IGLAWFIRM; 12 files; 1.07 MB file-tree; 17748 views
Phone
(248) 647-8590
Address
251 Merrill St., 2nd Floor Birmingham, Michigan 48009
Server Link 1
http://bxd5wnvfssoxzzzedu3gvpghzdcnwq7bzqg2ysekhwm5u3o4orfovjad.onion/data/IGLAWFIRM
Server Link 2
https://aur0rablog.io/data/IGLAWFIRM

Leak-site images (2)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture
I don't know who they are.
onion leak page14 KB