Datrose targeted by Akira ransomware group in alleged data leak

• Ransomware group: Akira
• Country: United States
• Sector: Professional Services
• Announcement date: June 24, 2025

Akira ransomware group claims data leak against Datrose

The Akira ransomware group has published a claim on its leak site involving the professional services company Datrose. According to the announcement, which was posted on June 24, 2025, the group alleges that they have successfully compromised corporate data belonging to the organization. This development follows the group's pattern of targeting various sectors to pressure victims into paying ransoms through the threat of public data disclosure.

The incident is characterized as a data leak claim. The Akira group has listed approximately 5 GB of data on their leak site, asserting that the information is ready for publication. While the group has made these claims, it is important to note that the details provided originate solely from the threat actor's announcement.

Details of the claimed data breach

The announcement made by the Akira group alleges that the stolen information includes various documents related to the business processes of Datrose. The group claims that the compromised data is significant enough to impact the company's internal operations and sensitive information management. No screenshots were provided by the group to verify the contents of the alleged leak.

Based on the information released by the group, the following types of data are claimed to be involved in the breach:

• Employee personal data
• Financial data
• Confidentiality agreements

This type of data exposure is a hallmark of modern ransomware operations. In many cases, attackers do not just encrypt systems to disrupt operations; they also focus on exfiltrating sensitive information to use as leverage in negotiations.

About Datrose

Datrose is a business outsourcing company that provides a variety of professional services. The organization specializes in document management, mail services, and contact center solutions. Additionally, the company offers accounts payable and staffing services to its clients, making it a central hub for various administrative and operational business processes.

Analysis and potential impact

This alleged leak may pose significant identity theft risks due to the exposure of personal employee information. The disclosure of financial data could potentially impact business operations and weaken supply chain security. Because the organization is based in the United States, the incident may be subject to data breach notification requirements under relevant state laws and federal regulations.

The Akira group frequently employs double-extortion tactics. This method involves both encrypting a victim's data and threatening to leak sensitive information on a public forum if a ransom is not paid. Such tactics are designed to maximize pressure on the victim, often leading to significant reputational damage if the data is indeed published. Information regarding the specific capabilities and motivations of the Akira group remains limited.

For organizations operating in the professional services sector, such incidents highlight the importance of robust data protection strategies. Common defensive steps include implementing strict access controls, maintaining comprehensive backups, and ensuring continuous monitoring of network traffic to detect unauthorized data exfiltration. Protecting sensitive employee and financial information is critical to maintaining trust with clients and ensuring long-term operational stability.