Bervar and Jones targeted by Akira ransomware group

• Ransomware group: Akira
• Country: United States
• Sector: Professional Services
• Announcement date: May 9, 2025

The Akira ransomware group has claimed responsibility for a data breach involving the law firm Bervar and Jones. According to an announcement made on the group's leak site on May 9, 2025, the threat actors allege they have successfully exfiltrated a significant volume of sensitive information from the organization.

Details of the alleged attack

The Akira ransomware group has announced that it has obtained over 102 GB of data belonging to Bervar and Jones. The group claims that the stolen data includes essential corporate documents. Following the initial breach, the group listed the files on their dedicated leak site, accompanied by threats of further publication if their demands are not met. While the group has made these claims, no screenshot has been provided to verify the contents of the stolen data.

The attack is claimed to have taken place on April 7, 2025. Ransomware groups often utilize various methods to gain unauthorized access to a network. Public information regarding the Akira group suggests they have been active since early 2023 and may exploit VPN vulnerabilities to gain unauthorized access to target environments. This type of intrusion often involves a period of lateral movement within a network to identify and aggregate sensitive files before the final encryption or exfiltration phase.

Claimed sensitive data types

The group claims that the leaked data contains highly sensitive information that could impact various stakeholders. The specific types of data mentioned in the claim include:

• Medical records
• Driver's licenses
• Passports
• Birth and death certificates
• Confidential court files
• Client financial data
• Non-disclosure agreements

About Bervar and Jones

Bervar and Jones is a law firm based in Hawaii. Led by Ward D. Jones, the firm has been providing legal services for over 30 years, handling trials in state courts, federal courts, and arbitration proceedings.

Implications and risks

The nature of the allegedly leaked data may pose risks of identity theft and fraud for the firm's clients. Given the firm's legal practice, the breach could trigger significant legal and regulatory consequences regarding attorney-client privilege. Data breach notification requirements under US state laws and federal regulations may apply to this incident.

The Akira group employs double-extortion tactics, a method where attackers not only encrypt the victim's systems but also steal sensitive data to use as leverage. This approach can exacerbate secondary risks if the data is eventually published online. In such scenarios, the threat of public exposure is used to pressure the victim into paying the ransom.

For organizations in the professional services sector, such incidents highlight the critical importance of robust cybersecurity frameworks. Common defensive steps for organizations include implementing multi-factor authentication, ensuring all VPNs and remote access points are fully patched, and maintaining rigorous monitoring of network traffic to detect unauthorized data exfiltration. Protecting sensitive client information is paramount to maintaining professional trust and adhering to legal and regulatory standards.