Akira ransomware group lists Ostrolenk Faber on leak site

• Ransomware group: Akira
• Country: United States
• Sector: Professional Services
• Announcement date: October 14, 2025

Akira ransomware group claims data theft from Ostrolenk Faber

The Akira ransomware group has listed the law firm Ostrolenk Faber on its dedicated leak site, claiming to have exfiltrated a significant amount of sensitive information. According to the announcement made on October 14, 2025, the threat actor group claims to possess over 43 GB of data allegedly belonging to the organization. This development follows the group's established pattern of targeting high-value entities to exert pressure through the threat of data publication.

The listing appeared on the group's leak site on October 14, 2025, the same date the group claims the attack occurred. The Akira group has signaled its intention to publish corporate documents, specifically targeting files related to the firm's intellectual property legal operations. This tactic is a hallmark of the double-extortion method used by modern ransomware groups, where attackers not only encrypt a victim's systems but also steal sensitive data to use as leverage during ransom negotiations.

Details of the alleged data leak

While no screenshots were provided by the attackers to verify the contents of the stolen files, the announcement detailed a wide range of sensitive information that has allegedly been compromised. The group claims to have access to various categories of documents that could impact both the firm and its clientele. The leaked data is said to include:

• Employee personal data
• Customer identification data (including SSN, name, date of birth, and address)
• Financial records
• Contracts and NDAs
• Project files

The inclusion of Social Security Numbers (SSN) and other personally identifiable information (PII) increases the severity of the potential breach, as such data is highly valuable for identity theft and fraudulent activities.

About Ostrolenk Faber

Ostrolenk Faber LLP is a prominent law firm that has been operating since 1929. The firm specializes in intellectual property law and provides a variety of legal consulting services. Their expertise covers both domestic and international matters involving patents, trademarks, and copyrights, making them a critical service provider for entities managing complex intellectual property portfolios.

Analysis and potential implications

The claims made by the Akira group pose significant secondary risks to the firm's employees and clients. The exposure of sensitive identification data, such as SSNs and addresses, can lead to targeted phishing attacks and identity theft.

The Akira group, which has been active since early 2023, has been observed leveraging vulnerabilities in VPNs to gain unauthorized access to corporate networks. Their use of double-extortion tactics suggests a strategic intent to maximize pressure on the institution by threatening the public release of confidential legal and financial documentation.

In such scenarios, organizations in the professional services sector are often advised to strengthen their perimeter defenses, particularly regarding remote access solutions like VPNs. Implementing robust multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular data encryption audits are standard defensive measures to mitigate the risk of unauthorized access and data exfiltration.