Akira ransomware group claims data breach at Dunlap Codding

• Ransomware group: Akira
• Country: United States
• Sector: Professional Services
• Announcement date: July 25, 2025

Akira ransomware group claims data breach at Dunlap Codding

The Akira ransomware group has claimed responsibility for a cyberattack targeting Dunlap Codding, a professional services firm. According to an announcement made on the group's leak site, the threat actors allege they have successfully compromised the organization's network and exfiltrated a significant amount of sensitive information.

Details of the alleged attack

The announcement, published on July 25, 2025, states that the Akira ransomware group has listed 19 GB of data on their leak site. The threat actors claim to have gained unauthorized access to the firm's internal network, allowing them to obtain various corporate documents. While the group has posted the claim online, they have not provided any screenshots to verify the contents of the stolen data. The post indicates that the firm's data may be released publicly as a result of this incident.

Ransomware groups often utilize a double-extortion model during these types of attacks. In this model, the attackers do not just encrypt the victim's files to disrupt operations; they also steal sensitive data to use as leverage. By threatening to leak the stolen information on a public site, the attackers aim to pressure the organization into paying a ransom to prevent the exposure of confidential information. This tactic is particularly effective against organizations that handle sensitive client data, as the reputational and legal consequences of a leak can be devastating.

Alleged compromised data types

According to the information provided in the group's post, the allegedly compromised data includes a wide range of sensitive documents. The specific types of data mentioned include:

• Personal client files
• Financial documents
• Project data
• Patent documents
• Court files
• Hearing notes
• Protocols

About Dunlap Codding

Dunlap Codding is a law firm based in Oklahoma City. The firm provides legal consulting services to a diverse range of clients, including international, national, and regional entities. Given its role in providing legal consulting, the firm handles highly sensitive information involving legal matters and client confidentiality.

Potential impact and industry implications

This alleged breach may pose significant risks regarding client confidentiality and intellectual property rights, given the firm's nature as a law firm. The content of the leaked data could lead to the exposure of client personal information and facilitate targeted phishing attacks against the firm or its clients. Because the firm is based in the United States, the incident may trigger legal processes under state laws and relevant data protection regulations.

The Akira group is known to operate using a double-extortion model and may utilize vulnerabilities in VPNs to gain initial access to a network. Such vulnerabilities often serve as an entry point for attackers to move laterally through a corporate environment. For organizations in the professional services sector, maintaining robust security postures is critical to protecting client trust and commercial reputation.

To defend against such threats, organizations typically implement multi-factor authentication, maintain regular offline backups, and conduct frequent vulnerability assessments. Protecting against initial access vectors, such as VPN vulnerabilities, is a fundamental component of modern cybersecurity defense. The publication of alleged data can result in negative impacts on a firm's commercial reputation, making proactive defense and incident response planning essential for maintaining business continuity and client confidence.