Goldberg & Osborne listed by Akira ransomware group

• Ransomware group: Akira
• Country: United States
• Sector: Professional Services
• Announcement date: July 17, 2025

Akira ransomware group claims data breach at Goldberg & Osborne

The Akira ransomware group has listed the professional services firm Goldberg & Osborne on its dedicated leak site. According to an announcement posted on July 17, 2025, the threat actors claim to have successfully exfiltrated a significant volume of corporate information, totaling approximately 150 GB of data.

This type of announcement is a common tactic used by modern ransomware groups. These groups often operate via leak sites, which serve as a public platform to pressure victims into paying ransoms. By publishing the names of targeted organizations, these actors aim to damage the reputation of the victim and increase the pressure to comply with their demands.

Details of the alleged attack

The threat actors behind the Akira group allege that they gained unauthorized access to the Goldberg & Osborne network on July 16, 2025. This means the initial compromise and subsequent data exfiltration were claimed to have occurred just one day before the public announcement was made on the leak site.

The group is reportedly employing a double-extortion strategy. In a double-extortion scheme, attackers do not merely encrypt a victim's files to disrupt operations; they also steal sensitive data beforehand. The threat of releasing this stolen information publicly serves as a secondary layer of leverage, ensuring that even if the organization can restore its systems from backups, the threat of a data leak remains a potent weapon for the attackers.

The scope of the alleged data theft

The announcement made by the Akira group specifies that the 150 GB of data contains a wide variety of sensitive information. While no screenshots were provided to verify the contents of the stolen files, the group claims the cache includes various corporate and highly sensitive personal documents. The alleged stolen data includes:

• Client personal data
• Passports
• Medical records
• Driver's licenses
• Financial data
• NDAs
• Court documents

The inclusion of such diverse data types suggests a deep penetration into the organization's file servers and databases, targeting both corporate operational files and the private information of their clientele.

Potential impact and defensive considerations

This alleged breach poses significant risks, particularly regarding identity theft and fraud for the clients of Goldberg & Osborne. The exposure of highly sensitive items, such as medical records and government-issued identification like passports and driver's licenses, could lead to severe legal consequences. In the United States, the exposure of medical data may trigger regulatory scrutiny under HIPAA and various state-level data protection laws.

Furthermore, the use of double-extortion tactics can have a lasting negative impact on an organization's operational continuity and its professional reputation. If the breach is confirmed, the individuals whose data was allegedly stolen could face an increased risk of targeted phishing attacks, as attackers may use the stolen information to craft highly convincing fraudulent communications.

Given that the Akira group has a known history of exploiting vulnerabilities in VPN (Virtual Private Network) solutions, such incidents often highlight the need for a comprehensive review of an organization's network security posture. For organizations in the professional services sector, maintaining robust security protocols is essential to protect client trust. Defensive measures typically include implementing multi-factor authentication, maintaining strict patch management for all remote access gateways, and ensuring continuous monitoring of network traffic to detect unauthorized data exfiltration early in the attack lifecycle.