Business Automation Specialists of Minnesota targeted by Akira ransomware

• Ransomware group: Akira
• Country: United States
• Sector: Technology
• Announcement date: March 4, 2026

Akira ransomware group claims data breach at Business Automation Specialists of Minnesota

The Akira ransomware group has issued a claim involving Business Automation Specialists of Minnesota, alleging that they have successfully exfiltrated a significant amount of sensitive information from the organization. According to an announcement posted on a leak site on March 4, 2026, the threat actor group claims to have compromised data belonging to the firm, which was allegedly targeted during an attack occurring on February 2, 2026.

The group has asserted that they have obtained approximately 10 GB of corporate data. While the group has made this claim regarding the volume of information stolen, they have not provided any specific details regarding a ransom demand. Furthermore, no screenshots were provided by the attackers to verify the contents of the stolen files at the time of the announcement.

Details of the alleged data exfiltration

The Akira group's post indicates that the stolen data is intended for release in the near future. The information allegedly taken from the organization's systems is described as being highly sensitive, encompassing both corporate and personal documentation. The claims suggest a wide variety of file types were compromised during the breach.

The data allegedly included in the leak consists of the following items:

• Employee passports
• Driver's licenses
• Medical records
• Non-disclosure agreements
• Financial data
• Client files

The presence of such diverse data types, ranging from highly personal identification documents to sensitive business contracts, highlights the potential impact of the alleged breach on both the organization and its stakeholders.

About Business Automation Specialists of Minnesota

Business Automation Specialists of Minnesota (BASM) is a Microsoft partner that focuses on specialized software solutions. The company specializes in Microsoft Dynamics 365 Business Central and NAV solutions. In its capacity as a service provider, the firm offers a range of professional services including implementation, consulting, customization, and technical support to various businesses.

Potential impact and security implications

This alleged breach carries significant risks for the organization, its employees, and its clients. The exposure of sensitive personal information, such as medical records, passports, and driver's licenses, significantly increases the risk of identity theft and fraud for the individuals involved. Additionally, the exposure of such data could lead to intense regulatory scrutiny under various state and federal data protection laws within the United States.

The Akira group is known for employing double-extortion tactics. In these scenarios, attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage. They threaten to leak the stolen data on public forums if the ransom is not paid, thereby causing reputational damage and the potential disclosure of trade secrets. For an organization like BASM, which handles client information and project files, the publication of this data could lead to a loss of trust and significant business impact.

Regarding the technical methods used by the group, information is limited, but they are known to frequently exploit vulnerabilities in Virtual Private Networks (VPNs) to gain initial access to corporate networks. This highlights a common trend in modern cyberattacks where perimeter defenses are targeted to facilitate lateral movement and data exfiltration.

To mitigate the risks associated with such breaches, organizations often need to inform their stakeholders to prevent targeted phishing attacks that may follow a data leak. General defensive measures for organizations in the technology and consulting sectors typically involve hardening remote access points, implementing multi-factor authentication, and maintaining strict monitoring of network traffic to detect unauthorized data movement.