Akira ransomware group lists Huber , Erickson & Bowman on its leak site

• Ransomware group: Akira
• Country: United States
• Sector: Professional Services
• Announcement date: October 30, 2025

Akira ransomware group claims data breach at Huber, Erickson & Bowman

The Akira ransomware group has reportedly listed a significant amount of data on its leak site, claiming the information belongs to the professional services firm Huber, Erickson & Bowman. According to the announcement made on October 30, 2025, the group alleges that the breach occurred on the same day the leak was posted. The group claims to have exfiltrated 66 GB of data, which they assert contains sensitive information belonging to both the firm's clients and its employees.

Ransomware attacks involving data leaks often follow a pattern known as double extortion. In these scenarios, threat actors do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive information to use as leverage. By threatening to publish private data on a public leak site, the attackers aim to pressure the victim into paying a ransom to prevent the exposure of confidential records. This tactic significantly increases the pressure on organizations, as the consequences of a leak often extend far beyond immediate operational downtime.

Details of the alleged data leak

While no screenshots have been provided to verify the contents of the leak, the Akira group has made specific claims regarding the types of information contained within the 66 GB of stolen data. The group states that the breach includes a wide range of sensitive personal and financial documentation. Specifically, the leaked data is alleged to include:

• Client personal information
• Employee personal information
• Driver's licenses
• Social security cards
• Credit card information
• Accounting records

The inclusion of such diverse data types—ranging from identity documents like social security cards and driver's licenses to financial details such as credit card information and accounting records—suggests a highly intrusive breach. The exposure of these specific elements can lead to various secondary risks, including identity theft and fraud for the individuals whose information has been compromised.

Potential impact and industry implications

The alleged breach at Huber, Erickson & Bowman carries significant risks for the firm and the parties it serves. Because the firm operates within the United States, this incident could potentially trigger legal consequences under various state-level data protection laws and federal regulations. The exposure of detailed accounting records is particularly concerning, as it may create supply chain risks for the various organizations that rely on the firm's professional services.

Furthermore, the publication of such sensitive data can lead to secondary phishing attacks, where criminals use the stolen information to craft highly convincing fraudulent communications. The group's known tendency to exploit vulnerabilities in Virtual Private Networks (VPNs) highlights a common trend in modern cyberattacks, where perimeter security weaknesses are leveraged to gain initial access to a network.

For organizations in the professional services sector, such incidents underscore the necessity of a comprehensive review of cybersecurity infrastructure. Defensive strategies often include implementing multi-factor authentication, maintaining rigorous patch management schedules to close vulnerabilities, and ensuring that remote access solutions like VPNs are strictly secured. Protecting client and employee data is not only a technical requirement but a critical component of maintaining commercial reputation and regulatory compliance.