Texas State Bar Hit by Major Data Breach: The Verdict Is In

A short intrusion window, a long list of stolen data types.

The State Bar of Texas notified roughly 2,700 people that their data was taken in a breach that ran from January 28 to February 9, 2025, and was discovered on February 12. Notifications also went to a small number of out-of-state victims, including two in New Hampshire and eight in Massachusetts.

The stolen data set is the kind that fuels identity theft for years. According to reporting by Comparitech, the compromised information included names, Social Security numbers, financial account details such as account and card numbers, driver's licenses and other government-issued IDs, medical information, and health insurance information. INC Ransom also leaked samples of what appear to be legal case documents, which is the part that should worry any firm holding privileged material.

• The dwell time was the real problem. Attackers had roughly 12 days inside the network before detection, and detection came 3 days after they stopped. That window is where the damage happens.
• The Bar has not confirmed the ransom outcome. The State Bar has not verified INC Ransom's claim, and the exact entry point and whether any ransom was paid remain undisclosed.
• Victims got Experian monitoring. The Bar offered free credit and identity-theft monitoring through Experian, with an enrollment deadline of July 31, 2025, plus advice to consider credit freezes and fraud alerts.

The group behind the attack, by the numbers.

INC Ransom is a ransomware gang that surfaced in July 2023 and hits healthcare, education, government, and legal targets. It runs double extortion: steal the data, threaten to publish it, then demand payment whether or not it also encrypts systems.

The group's usual way in is spear phishing and exploiting known, unpatched vulnerabilities in edge software. Security researchers have tied INC Ransom activity to internet-facing weaknesses in products like Citrix, Fortinet, and remote-management tools. It listed the State Bar of Texas on its dark web extortion page in early 2025 and posted sample files to pressure a payment. For a small firm, the takeaway is direct: the entry points INC Ransom favors are the same ones a Houston business leaves exposed when patching slips and multi-factor authentication is optional.

The State Bar breach sits inside a broader run at the legal sector.

The legal sector drew unusual attacker attention in 2025. INC Ransom and the Silent Ransom Group both ran focused campaigns against law firms, and the FBI issued a warning to US-based firms about a group stealing legal data. Threat-intelligence firm Halcyon tracked more than 200 ransomware incidents against law firms from 2025 into early 2026.

Attackers target legal organizations for three plain reasons: the data is unusually sensitive, deadlines and privilege create pressure to resolve incidents fast, and there is a perception that firms will pay to protect attorney-client material. A Houston CPA practice or law firm does not need to be famous to fit that profile. It needs to hold client Social Security numbers, financial records, and case files, which nearly every firm does. In 35 years doing this, the firms that got hit were rarely the biggest names in town. They were the ones that assumed size was a shield.

• Privilege raises the stakes. Leaked case documents are not just a compliance problem. They can compromise active matters and client relationships in ways a stolen spreadsheet never would.
• Small firms feel the same blast radius. A downstream vendor or co-counsel to a larger enterprise becomes a target because it is the softer path to the same valuable data.
• Regulators are watching. Texas breach-notification duties and industry rules mean the cleanup cost lands on top of the breach itself, and small firms carry that weight without an enterprise legal team.