Cook Brown listed on Akira ransomware leak site

• Ransomware group: Akira
• Country: United States
• Sector: Professional Services
• Announcement date: September 18, 2025

Akira ransomware group claims Cook Brown data breach

The professional services firm Cook Brown has been listed on the leak site of the Akira ransomware group. According to the announcement made on September 18, 2025, the threat actors claim to have successfully targeted the organization, alleging that the breach occurred on September 16, 2025. The group has claimed to have obtained 160 GB of corporate data belonging to the firm and has indicated that this information is slated for publication.

The Akira group is identified as a Ransomware-as-a-Service (RaaS) entity that first emerged in early 2023. This group is known for employing double extortion tactics, a method where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage for blackmail. By threatening to leak stolen data on public forums, the attackers increase the pressure on the victim to pay the ransom. Akira is reported to target various environments, including Windows, Linux, and virtualization platforms, often gaining initial access through compromised VPN accounts.

Details of the alleged data theft

While the threat actors have not provided any screenshots to verify their claims, the announcement specifies a wide array of sensitive information that has allegedly been compromised. The stolen data is said to include a variety of highly sensitive documents and personal identifiers that could pose significant risks to the individuals involved.

The data types mentioned in the claim include:

• Client personal data
• Social Security Numbers (SSNs)
• Employee passports
• Police reports
• Court documents
• Medical information
• HR data
• Contracts
• Payment details
• Non-disclosure agreements

The exposure of such a diverse range of information, particularly including medical records and Social Security Numbers, highlights the potential severity of the breach for the affected parties.

About Cook Brown

Cook Brown LLP is a law firm that specializes in labor and employment law. The firm provides legal representation and consulting services to employers across various legal areas, including litigation, claims settlement, and labor relations.

Potential impact and risks

The alleged leak of this data may create significant secondary risks for both the clients and the employees of Cook Brown. The exposure of sensitive identifiers such as Social Security Numbers and passports can lead to identity theft, while the release of other private information could facilitate targeted phishing attacks against the firm's stakeholders.

Furthermore, the exposure of sensitive data, particularly medical information and SSNs, could lead to legal consequences under relevant US state laws and federal regulations. For a firm operating in the professional services sector, the impact of such a breach extends beyond immediate data loss; it can negatively affect the firm's operational continuity and its professional reputation. Additionally, because the firm handles sensitive legal and corporate information, the leaked data could potentially be leveraged by threat actors to facilitate supply chain attacks against other organizations.

In general, organizations facing such threats often look toward defensive measures such as implementing multi-factor authentication, securing VPN access, and maintaining robust backup strategies to mitigate the impact of ransomware and extortion attempts.