Barr and Barr targeted by Akira ransomware group

• Ransomware group: Akira
• Country: United States
• Sector: Professional Services
• Announcement date: October 1, 2025

Akira ransomware group claims data breach at Barr and Barr

The Akira ransomware group has claimed responsibility for a significant data breach involving the United States-based professional services firm, Barr and Barr. According to an announcement made on the group's leak site on October 1, 2025, the threat actors claim to have exfiltrated a substantial volume of corporate information from the organization.

The incident is categorized as a data leak announcement. The group has listed the stolen data on their platform, stating that the information is scheduled for publication. This follows activities reported on October 1, 2025, marking a direct threat to the integrity and confidentiality of the company's internal and client-facing data.

Details of the claimed exfiltration

The Akira ransomware group claims to have successfully stolen 323 GB of corporate data belonging to Barr and Barr. While the group has announced its intent to publish the stolen files, they have not provided any screenshots to verify the contents of the breach. The scale of the data exfiltration suggests a targeted effort to acquire sensitive organizational intelligence.

The alleged leaked data is reported to include a wide variety of sensitive documents. Based on the group's claims, the following types of information are involved:

• Employee personal data
• Passport scans
• Driver's licenses
• Financial records
• Client information
• Contracts

The inclusion of highly sensitive identity documents, such as passport scans and driver's licenses, indicates that the breach extends beyond mere corporate files into the private lives of the organization's personnel.

About Barr and Barr

Barr & Barr, Inc. is a construction company based in the United States. The firm operates as a general contractor for various industrial and commercial projects. Their professional services include construction management and building information modeling (BIM) services, making them a key player in the management and technical oversight of complex construction endeavors.

Risk assessment and industry implications

This incident highlights the growing threat of double-extortion tactics used by ransomware groups like Akira. In a double-extortion scenario, attackers do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive data to use as leverage. By threatening to publish the stolen information on a public leak site, the attackers aim to pressure the victim into paying a ransom to prevent the exposure of trade secrets and sensitive data.

The nature of the data involved in this claim—including financial records, contracts, and client information—could lead to significant reputational damage if the files are released. Furthermore, the exposure of employee personal data, such as identification documents, significantly increases the risk of identity theft and targeted phishing attacks against the company's staff. Such attacks often use stolen information to craft highly convincing messages designed to trick employees into revealing further credentials or installing malware.

From a legal perspective, the breach may trigger specific obligations. Given the organization's location and the type of data involved, legal processes under US data protection laws and state-level notification requirements may be activated. Organizations in the professional services and construction sectors must remain vigilant, as the exposure of project files and agreements can compromise competitive advantages and trade secrets.

The group's known history suggests that VPN vulnerabilities may be exploited to gain initial access to networks. Therefore, it is critical for organizations to conduct thorough reviews of their network security protocols. Defensive measures typically include implementing multi-factor authentication, maintaining rigorous patch management schedules, and monitoring for unusual data exfiltration patterns. For companies in sectors handling sensitive client and employee information, maintaining robust encryption and strict access controls is essential to mitigating the impact of such targeted cyberattacks.