Echo listed on Akira ransomware leak site

• Ransomware group: Akira
• Country: United States
• Sector: Retail & E-Commerce
• Announcement date: August 27, 2025

The Akira ransomware group has listed the American company Echo on its leak site, claiming a significant data breach. According to the announcement published on August 27, 2025, the threat actors assert that they have successfully exfiltrated a large volume of corporate information belonging to the organization.

The alleged attack and claims

The Akira group claims to have exfiltrated 331 GB of corporate data belonging to Echo. The threat actor states that the stolen data includes financial records and personal information. This announcement was made public on August 27, 2025, marking the date of the claimed attack as well. While the group has made these claims, it is important to note that no screenshots were provided by the attackers to support their assertions regarding the stolen files.

Ransomware attacks of this nature often involve a process known as double extortion. In this scenario, threat actors do not merely encrypt a company's systems to disrupt operations; they also steal sensitive data before the encryption occurs. This allows the attackers to threaten the victim with the public release of their information if a ransom is not paid. This method significantly increases the pressure on an organization, as the threat of a data leak can lead to severe reputational damage and legal consequences, regardless of whether the company can restore its systems from backups.

Details of the alleged data theft

The content of the alleged leak is extensive and covers various sensitive areas of the company's operations. According to the claims made by the Akira group, the stolen data includes a wide range of documents and personal identifiers. The specific types of information mentioned in the leak claim include:

• Financial audit reports
• Payment details
• Invoices
• Employee and customer information, such as driver's licenses and Social Security Numbers
• Contact details
• Birth and death certificates
• Medical information
• Confidential agreements
• Other personal documents

The presence of such highly sensitive information, including Social Security Numbers and medical records, indicates a high level of potential impact for the individuals whose data is involved. When such data is compromised, it often serves as a primary target for subsequent criminal activities.

About Echo

Echo is an American company founded in 1923, specializing in the design, marketing, and distribution of home and fashion accessories. Established by Edgar and Theresa Hyman, the firm is known for its diverse range of patterns and color palettes. As a long-standing entity in the retail and e-commerce sector, the company maintains a broad presence in the market.

Potential risks and industry implications

If the leak claim is verified, there may be a risk of identity theft and targeted phishing attacks for the company's employees and customers. Given the sensitivity of the alleged data, the company may face legal sanctions under US-based regulations and data privacy laws. The double extortion method employed by the Akira group could increase secondary risks if the data is published or if the ransom is not paid. Indirect effects on the company's supply chain partners may also be observed.

The Akira group's activities suggest a focus on the exploitation of VPN vulnerabilities, a common entry point for many ransomware operations. For organizations in the retail and e-commerce sectors, protecting remote access points is a critical defensive step. General best practices for defending against such threats include implementing multi-factor authentication (MFA) on all external-facing services, such as VPNs, and maintaining rigorous patch management schedules to close known vulnerabilities. Furthermore, robust data encryption and network segmentation can help limit the movement of an attacker and the amount of data that can be exfiltrated during a breach.