Building Trades listed on Akira ransomware leak site

• Ransomware group: Akira
• Country: United States
• Sector: Professional Services
• Announcement date: December 24, 2025

Akira ransomware group claims data breach at Building Trades

The Akira ransomware group has officially listed the Los Angeles/Orange Counties Building and Construction Trades Council on its dedicated leak site. According to the announcement, the threat actors claim to be in the process of preparing a massive dataset for public release. This alleged breach involves a significant volume of information, which the group claims totals 14 GB in size.

The announcement was posted on the group's leak site on December 24, 2025. While the disclosure occurred at the end of the year, the threat actors cite the actual date of the attack as November 25, 2025. This discrepancy between the attack date and the public announcement is a common occurrence in ransomware operations, where attackers often take time to exfiltrate data and negotiate before moving to the leak phase.

Details of the alleged data theft

The Akira ransomware group has not provided any screenshots to substantiate their claims in the leak announcement. Despite the lack of visual evidence, the group alleges that the stolen dataset contains a wide array of sensitive information. This data is reportedly intended to target not just the organization's corporate operations, but also the private lives of its members and their families.

The threat actor claims that the exfiltrated data includes the following types of sensitive information:

• Passport scans
• Driver's licenses
• Personal forms
• Financial data
• Client information

The inclusion of such highly sensitive identity documents and financial details highlights the severity of the alleged incident. In modern ransomware attacks, the theft of such data is often used as leverage to pressure organizations into paying a ransom.

About the target organization

The target of this alleged attack is the Los Angeles/Orange Counties Building and Construction Trades Council. This organization serves as a representative body for 48 local unions and provides support to approximately 160,000 skilled workers. Beyond its representative functions, the council is also responsible for managing apprenticeship training programs that serve both the public and private sectors within the construction industry.

Impact and security implications

The nature of the data claimed by the Akira group suggests a high risk of identity theft for the organization's employees and clients. Because the alleged stolen files include government-issued identification and financial details, the impact of this breach could extend far beyond the organization's internal systems. Given the sensitive nature of the information, it is likely that legal proceedings under US state laws and federal privacy regulations could be initiated following the publication of this data.

This incident follows the pattern of double-extortion tactics frequently employed by ransomware groups. In a double-extortion scenario, attackers not only encrypt an organization's data to disrupt operations but also steal the data to threaten its public release. This tactic is designed to maximize the pressure on the victim, as the threat of a data leak can cause significant reputational damage and legal liability even if the organization can restore its systems from backups.

The publication of such data often leads to secondary waves of attacks, such as targeted phishing campaigns. Once an attacker possesses personal information, they can craft highly convincing messages to deceive individuals into revealing even more credentials or funds. Furthermore, the scale of the organization—representing 160,000 workers—means that the potential impact of this breach could be quite broad, affecting a massive number of individuals.

While public information regarding the Akira group remains limited, their past activities suggest a specific method of entry. They have been known to gain network access by exploiting vulnerabilities in VPN accounts. To defend against such threats, organizations in the professional services sector typically focus on strengthening their perimeter security, implementing multi-factor authentication (MFA) on all remote access points, and maintaining strict monitoring of network traffic to detect unauthorized exfiltration of data.