Forella Group allegedly targeted by Akira ransomware group

• Ransomware group: Akira
• Country: United States
• Sector: Professional Services
• Announcement date: February 3, 2026

Akira ransomware group claims data breach at Forella Group

The Akira ransomware group has listed a significant amount of data allegedly belonging to Forella Group on their dedicated leak site. According to the announcement, the group claims to have obtained approximately 457 GB of data from the organization. This claim was made on February 3, 2026, coinciding with the date the group alleges the attack occurred.

Ransomware leak sites serve as a platform for cybercriminal groups to exert pressure on their victims. In these scenarios, the attackers typically employ a tactic known as double extortion. This method involves not only encrypting a victim's systems to disrupt operations but also stealing sensitive information to threaten public disclosure. By threatening to release confidential data, the attackers aim to increase the likelihood of receiving a ransom payment, as the threat of a data leak can cause significant reputational and legal damage.

Details of the alleged data theft

The Akira ransomware group published an announcement regarding Forella Group on February 3, 2026. The group claims to have successfully obtained various types of corporate data and has expressed an intention to release this information in the near future. While the group has made these claims, no screenshots were provided to verify the contents of the alleged breach.

The data allegedly stolen by the group is described as being highly sensitive and includes a wide range of personal and corporate information. The items listed as being part of the breach include:

• Employee personal information
• Social Security Numbers (SSNs)
• Passport information
• Driver's licenses
• Health information
• Credit card information
• Financial records
• Non-disclosure agreements (NDAs)
• Contracts and agreements

The breadth of this alleged data set suggests a comprehensive compromise of both personnel and corporate administrative files.

About Forella Group

Forella Group is a professional services firm based in the United States. The company specializes in providing consulting services tailored to the construction industry. Their expertise covers several critical areas, including cost estimating, project management, scheduling, and dispute resolution.

As a Minority Business Enterprise (MBE), the organization provides specialized construction economics and expert investigation services to its diverse client base. Such specialized services often involve handling sensitive project details and high-level financial data, making the organization a potential target for sophisticated cyber threats.

Impact and security implications

The use of double-extortion methods by the Akira group can have profound consequences for an organization. Beyond the immediate disruption of operational continuity, the exposure of sensitive employee data—such as SSNs, health information, and financial records—creates significant long-term risks. These risks include the potential for identity theft and the execution of highly targeted phishing attacks against both the employees and the company itself.

Because Forella Group is based in the United States, this incident may trigger specific legal obligations. Data breach notification requirements under various state laws and federal regulations may be activated depending on the nature of the compromised information. Furthermore, such leaks can create secondary risks for the organization's supply chain partners, who may also be at risk if shared data is compromised.

From a technical perspective, the Akira group has demonstrated a tendency to exploit vulnerabilities in Virtual Private Networks (VPNs) to gain initial access to networks. This highlights the necessity for organizations to maintain rigorous network security processes. To defend against such threats, organizations in the professional services sector often implement multi-factor authentication, conduct regular vulnerability assessments, and maintain strict monitoring of remote access points to mitigate the risk of unauthorized entry.