Akira ransomware group lists Jones Soda (Stock Symbol: JSDA) on its leak site

• Ransomware group: Akira
• Country: United States
• Sector: Agriculture and Food Production
• Announcement date: September 19, 2025

Akira ransomware group claims theft of Jones Soda data

The Akira ransomware group has officially listed Jones Soda on its leak site, claiming to have exfiltrated a significant amount of corporate data belonging to the organization. According to the announcement made on September 19, 2025, the group alleges that the breach occurred following an attack on August 15, 2025. The group claims to have stolen approximately 66 GB of data, though no specific file count or ransom demand has been provided in the public announcement.

The Akira group is known for utilizing double-extortion tactics, a method where attackers not only encrypt an organization's systems but also steal sensitive information to use as leverage. By threatening to release stolen data on a public leak site, the threat actors attempt to pressure the victim into paying a ransom to prevent the exposure of confidential information. Information regarding the specific origins and technical capabilities of this group remains limited.

Details of the alleged data exfiltration

The announcement made by the Akira group suggests that the stolen information is highly sensitive and covers various aspects of the company's operations and personnel. While no screenshots were provided to verify the contents of the stolen files, the group claims the data includes a wide range of corporate and personal information. The alleged breach involves the following types of data:

• Employee personal data
• Financial records
• Payment details
• Credit card details
• Contracts
• Non-disclosure agreements

The exposure of such diverse datasets, ranging from individual identity markers to high-level business agreements, represents a significant security incident for the targeted entity.

About Jones Soda

Jones Soda Co. is an American craft soda manufacturer based in Seattle, known for its unique packaging and wide variety of flavors. The company has also expanded into the cannabis-infused beverage market. As a prominent player in the food and beverage industry, the organization maintains various business relationships and a large workforce.

Impact and implications of the alleged breach

The nature of the allegedly leaked data poses a high risk of identity theft and fraud for both employees and business partners. The inclusion of Social Security numbers, addresses, and contact details means that individuals within the organization may be targeted for secondary attacks or phishing attempts. Furthermore, the exposure of sensitive business documents, such as contracts and non-disclosure agreements (NDAs), could negatively impact the company's reputation and its professional relationships with third parties.

Because Jones Soda is a United States-based company, the organization may face data breach notification obligations under relevant state laws and federal regulations. The disclosure of commercial agreements, including those with major entities like PepsiCo, adds a layer of complexity to the incident, potentially affecting strategic business interests.

In general, when organizations face such threats, defensive measures often include implementing robust multi-factor authentication, maintaining offline backups, and conducting regular security awareness training to mitigate the risk of phishing. The public release of data by groups using double-extortion tactics can facilitate ongoing targeted attacks against the victims long after the initial breach has occurred.