Bergeson listed on Akira ransomware leak site

• Ransomware group: Akira
• Country: United States
• Sector: Professional Services
• Announcement date: November 26, 2025

Bergeson targeted by Akira ransomware group

The law firm Bergeson has been listed on the leak site of the Akira ransomware group. According to the announcement made on November 26, 2025, the threat actors claim to have compromised the organization's systems and intend to publish a significant volume of stolen information.

The Akira group has announced that it intends to publish over 33 GB of data allegedly belonging to Bergeson. The listing includes a claim that the institution was compromised on November 10, 2025. The group claims to have obtained various corporate and personal documents from the firm. While the group has made these claims, no screenshot has been provided to verify the contents of the stolen data.

Claimed data and affected information

The listing specifies a wide array of sensitive information that the group claims to have exfiltrated from the firm. The data allegedly includes various types of financial, personal, and confidential documentation. The specific categories of data mentioned in the leak site announcement include:

• Financial data (audits, payment details, invoices)
• Employee and customer information
• Passports
• Driver's licenses
• Social Security Numbers
• Death/birth certificates
• Confidential information
• NDAs

The presence of such sensitive documentation, including identity documents and financial records, highlights the potential severity of the alleged breach. Ransomware groups often use this type of data in double-extortion tactics, where they not only encrypt an organization's systems but also threaten to leak sensitive information to pressure the victim into paying a ransom.

About Bergeson

Bergeson, LLP is a prominent law firm based in Silicon Valley, established in 1990. The firm specializes in representing individuals and companies in complex business disputes.

Analysis and potential impact

This alleged breach may pose significant risks of identity theft and fraud for the firm's employees and clients. As a US-based institution, the incident may trigger data breach notification requirements and legal proceedings under various state-level privacy laws.

Considering the Akira group's double-extortion tactics, the publication of this data could create a foundation for secondary attacks. Ransomware groups frequently use stolen data to conduct follow-up phishing campaigns or to target the victims' clients directly. The group's known tendency to exploit VPN vulnerabilities suggests that the institution's network security protocols may require a comprehensive review.

For organizations operating in the professional services sector, particularly law firms, maintaining the integrity of client data is paramount. Such incidents underscore the importance of robust network security, including the hardening of remote access points like VPNs, and the implementation of strict access controls. Organizations often rely on comprehensive incident response plans and continuous monitoring to detect and mitigate the risks associated with sophisticated ransomware groups like Akira.