Akantha listed on blacklock ransomware leak site

• Ransomware group: blacklock
• Country: Greece
• Sector: Technology
• Announcement date: May 16, 2025

The technology firm Akantha has been listed on the leak site of the blacklock ransomware group. In an announcement published on May 16, 2025, the threat actor claimed to have gained access to the organization's systems, marking a significant development in the ongoing landscape of cyber extortion.

The details of the claim

The blacklock group added Akantha to its dedicated leak site in an announcement released on May 16, 2025. According to the threat actor, the group successfully infiltrated the organization's infrastructure. While the announcement confirms the listing, the group provided a specific contact method for communication, offering an address via the encrypted messaging application Session. This method of communication is common among ransomware groups seeking to maintain anonymity while negotiating with targets or managing public pressure through their leak sites.

Ransomware leak sites function as a platform for double extortion tactics. In such scenarios, threat actors do not merely encrypt an organization's data to disrupt operations; they also steal sensitive information to use as leverage. By threatening to publish stolen data on these public sites, attackers aim to pressure the victim into paying a ransom to prevent the exposure of confidential information. This tactic significantly increases the pressure on the victimized organization, as the consequences of a leak can extend far beyond immediate operational downtime.

Data involved in the incident

Regarding the specifics of the alleged breach, the listing provides no details or sample files regarding the nature of the allegedly leaked data. No information was provided concerning the volume of data stolen or the specific file count involved in the incident. Furthermore, the group has not issued a ransom demand or specified a particular amount for the return of the data or the prevention of its release.

About Akantha

Akantha is a technology company that offers Portalis, a legal software specifically designed for lawyers. The company provides various digital solutions for law firm management, including document sharing, data hosting, and process tracking. By providing these specialized tools, the organization plays a role in the digital infrastructure used by legal professionals to manage their sensitive workflows and client information.

Impact and security implications

This incident may have a negative impact on the organization's data security processes. Since Akantha provides software to the legal sector, the leaked data could potentially contain sensitive information regarding client confidentiality and legal proceedings. This situation may trigger data breach notification obligations and legal sanctions under GDPR. The potential exposure of legal documents and client-related data poses a high risk to the privacy of the end-users who rely on the software for their professional operations.

Furthermore, targeted phishing attacks that could pose secondary risks to the organization's clients may be observed. When data from a service provider is compromised, the clients of that provider often become targets for follow-on social engineering attacks. Attackers may use the knowledge gained from the initial breach to craft highly convincing messages designed to steal credentials or further penetrate client networks.

In response to such threats, organizations in the technology and legal sectors often focus on strengthening their defensive posture. Common defensive steps include implementing robust access controls, maintaining rigorous patch management schedules, and conducting regular security audits. Additionally, monitoring for unauthorized access and maintaining comprehensive logging can help in detecting and responding to intrusions more effectively. Information about this specific group, blacklock, remains limited in the public domain.