AdMark Asia Group targeted by insomnia ransomware group

• Ransomware group: insomnia
• Country: United States
• Sector: Professional Services
• Announcement date: February 18, 2026

Insomnia group claims data breach at AdMark Asia Group

The threat actor known as insomnia has published data allegedly belonging to AdMark Asia Group on its dedicated leak site. This announcement, which appeared on February 18, 2026, marks a significant escalation in the ongoing targeting of professional services firms by ransomware operators. The group claims to have successfully breached the organization's systems, asserting that they have obtained various sensitive documents during the intrusion.

According to the claims made by the threat actor, the initial access to the organization's systems may have occurred as early as January 8, 2026. While the group has published the organization's name on their leak site, they have not provided specific information regarding the total volume of data stolen or the specific number of files compromised. Furthermore, no information was provided regarding a specific ransom demand or the total size of the data exfiltrated during the attack.

Details of the alleged data exposure

The threat actor has provided samples of documents that are purported to be related to the operational processes of AdMark Asia Group. These samples serve as evidence to support the group's claims of unauthorized access. The leaked content is described as containing highly sensitive information that could impact both the organization and the individuals involved in its business operations.

Based on the screenshots provided by the group, the following types of data are allegedly included in the leak:

• Passport data
• Travel documents
• Non-disclosure agreements
• Employment contracts

The presence of such documents suggests that the breach extends beyond corporate files into the realm of personally identifiable information (PII). In the context of modern cyberattacks, the exposure of identity documents like passports and travel permits presents a severe risk to the individuals whose data is contained within those files.

Organization profile and sector impact

AdMark Asia Group is an organization operating within the professional services sector and is based in the United States. This sector is often a high-value target for cybercriminals due to the sensitive nature of the client relationships and the high level of trust required to conduct business. The exposure of non-disclosure agreements (NDAs) and private partnership contracts is particularly damaging in this context, as it can lead to a loss of trust in third-party client relationships and potentially trigger significant legal repercussions.

Analysis and potential consequences

The alleged leak of personally identifiable information may increase the risk of identity theft for the affected individuals. Because the organization is based in the United States, the incident may necessitate compliance with various state-level data breach notification laws, which govern how and when organizations must inform victims and regulators about such compromises.

The tactics employed by the insomnia group appear to align with a double-extortion strategy. In a double-extortion scenario, threat actors do not merely encrypt an organization's data to demand a ransom for decryption; they also steal the data and threaten to publish it on public leak sites to pressure the victim into paying. This method increases the pressure on the victim, as the threat of public exposure can cause irreparable reputational damage and legal liability.

For organizations in the professional services sector, such incidents highlight the critical importance of robust data protection frameworks. To mitigate the risks associated with such attacks, organizations typically focus on implementing multi-factor authentication, maintaining rigorous patch management, and conducting regular security awareness training. Additionally, ensuring that sensitive client data and legal agreements are encrypted both at rest and in transit can provide an essential layer of defense against unauthorized access and subsequent exfiltration.