Hardesty & Hanover claims of data leak by Akira ransomware group

• Ransomware group: Akira
• Country: United States
• Sector: Professional Services
• Announcement date: December 9, 2025

The Akira ransomware group has announced that it has leaked data belonging to the engineering firm Hardesty & Hanover. According to a post on the group's leak site, the attackers claim to have gained unauthorized access to the institution's systems, resulting in a significant data breach.

The details of the claimed attack

The Akira ransomware group has listed a substantial amount of corporate data on their leak site, claiming the volume to be 323 GB. The announcement, which was published on December 9, 2025, asserts that the group has successfully breached the systems of Hardesty & Hanover. The group claims to possess sensitive information related to the firm's core operations, specifically targeting their infrastructure engineering and architectural design processes.

Ransomware attacks of this nature often involve a method known as double extortion. In this scenario, threat actors do not merely encrypt an organization's files to disrupt operations; they also exfiltrate sensitive data before the encryption occurs. The threat of leaking this stolen information on a public leak site serves as additional leverage to pressure the victim into paying a ransom. While the specific ransom demand for this incident has not been disclosed, the presence of the data on a leak site is a hallmark of this extortion tactic.

The scope of the alleged data theft

The information allegedly stolen by the Akira group is extensive and covers both personal and corporate domains. According to the group's announcement, the stolen dataset includes highly sensitive personal identifiable information (PII) belonging to employees. This includes items such as passports, driver's licenses, headshots, visas, and various forms containing personal details. The exposure of such documents poses a significant risk to the individuals involved, as these items are frequently used in identity theft and fraudulent activities.

Beyond personal employee data, the group claims to have obtained a wide array of confidential corporate documents. The alleged leak includes:

• Employee personal data
• Passport information
• Driver's license information
• Financial records
• Contracts
• Technical drawings

The group also claims to have acquired confidential documents, agreements, project files, and non-disclosure agreements (NDAs). It is important to note that no screenshots were provided by the group to verify the authenticity of the files. No information regarding the specific file count was provided in the announcement.

About Hardesty & Hanover

Hardesty & Hanover is a professional services firm based in New York. The organization specializes in several complex engineering disciplines, including infrastructure engineering, kinetic systems, architectural design, and geotechnical engineering. The firm is particularly well-known for its professional expertise in the design and management of bridges and movable structures.

Risks and implications of the breach

This incident suggests that the employees of Hardesty & Hanover may be at high risk of identity theft due to the nature of the stolen personal documents. Furthermore, the breach of confidential corporate documents, such as technical drawings and contracts, indicates that the firm's corporate confidentiality may be severely compromised. The presence of such sensitive information could trigger legal processes under US state laws and relevant data protection regulations.

Given the firm's specialized work in infrastructure engineering, the stolen data might pose risks related to industrial espionage or potential supply chain attacks. In such scenarios, attackers may use technical drawings or project files to identify vulnerabilities in critical infrastructure or to target the partners and clients within the supply chain. The limited public information available regarding the Akira group makes it difficult to assess the full scope of their operational patterns.

For organizations in the professional services and engineering sectors, such incidents highlight the necessity of robust defensive measures. Implementing multi-factor authentication, maintaining strict access controls, and conducting regular security audits are common defensive steps used to mitigate the risk of unauthorized access. Additionally, protecting intellectual property and technical designs is critical for maintaining the integrity of large-scale infrastructure projects.