Texas State Bar data breach leaks SSNs and financial info; ransomware gang claims responsibility

The State Bar of Texas this week confirmed it notified 2,700 Texans about a January 2025 data breach that compromised the following info:

• Names
• Social Security numbers
• Financial account info including account numbers, credit and debit card numbers
• Driver’s licenses or other government-issued ID
• Medical info
• Health insurance info

“[…] the State Bar determined that there was unauthorized access to their network between January 28, 2025 and February 9, 2025. During this time, the unauthorized actor was able to take certain information from their network,” says the Bar’s notice (PDF) to victims.

The Bar also notified a small number of victims residing outside of Texas, including two in New Hampshire and eight in Massachusetts.

Ransomware gang Inc claimed responsibility for the attack on February 27, 2025. The State Bar of Texas has not verified Inc’s claim. We do not yet know if the State Bar paid a ransom, how much Inc demanded, or how attackers breached the Bar’s network. Comparitech contacted the Texas State Bar and will update this article if it replies.

The Texas State Bar is offering eligible victims free credit monitoring through Experian.

Who is Inc Ransomware?

Inc is a ransomware gang that emerged in July 2023 and targets a wide range of victims in healthcare, education, and government. Its methods involve spear phishing and exploiting known vulnerabilities in software.

Inc has claimed responsibility for 86 confirmed ransomware attacks, plus another 280 unconfirmed claims that haven’t been acknowledged by the targeted organizations. In 2025, Inc claimed seven confirmed attacks and 61 unconfirmed.

The group attacked two other government entities in February 2025: Anne Arundel County, MD and the city of Fort St. John, BC. Neither paid a ransom.

Ransomware attacks on US government

Ransomware attacks on US government agencies and departments can lock down computer and steal data. Those organizations are then forced to either pay a ransom or face extended downtime, data loss, and putting data subjects at increased risk of fraud.

Comparitech researchers have logged 13 confirmed ransomware attacks against US government entities in 2025 so far. Other recently confirmed attacks include:

About the State Bar of Texas

Headquartered in Austin, the Texas Bar oversees all attorneys licensed to practice law in the state. It’s an agency under the control of the Texas Supreme Court. As of 2023, membership in the Texas State Bar surpassed 113,000 people.