Hogan Construction Group listed on Akira ransomware leak site

• Ransomware group: Akira
• Country: United States
• Sector: Manufacturing
• Announcement date: August 22, 2025

Akira ransomware group claims data breach at Hogan Construction Group

The Hogan Construction Group has been listed on the leak site associated with the Akira ransomware group. According to the claims made by the threat actors, the organization has suffered a significant data breach involving a substantial amount of sensitive information. The attackers claim to have obtained over 16 GB of data belonging to the organization.

The incident, as described by the threat actors, involves a breach that allegedly occurred on July 25, 2025. The Akira group has posted the organization on their leak site, stating that they gained access to various corporate documents following the alleged attack. The group is currently employing a double-extortion strategy, which is a common tactic in modern ransomware campaigns. In this method, attackers do not just encrypt an organization's systems to disrupt operations; they also steal sensitive data and threaten to publish it on public leak sites to pressure the victim into paying a ransom.

Claimed data types and contents

The leak announcement claims to contain a wide range of sensitive information that could impact various stakeholders of the organization. While no screenshots have been provided to verify the contents of the stolen data, the group asserts that the following types of information are involved:

• Financial data (including audits, payment details, and invoices)
• Employee and customer information
• Social Security Numbers
• Phone numbers and email addresses
• Death and birth certificates
• Other confidential corporate documents

The exposure of such sensitive personal identification information, particularly Social Security Numbers, presents significant risks to the individuals involved. Such data is highly valuable to malicious actors for fraudulent activities.

About Hogan Construction Group

Hogan Construction Group is a company that provides construction management services. It specializes in various complex projects, including interior renovations, design-build, historic restorations, and adaptive re-use projects.

Analysis and potential risks

The use of the double-extortion method by the Akira group may pose substantial risks to the organization's operational continuity and its overall reputation. The alleged exposure of Social Security Numbers and other personal data could lead to secondary risks for both employees and customers, such as identity theft and the occurrence of targeted phishing attacks.

Because the organization is based in the United States, the alleged breach may trigger legal obligations. Specifically, data breach notification requirements under relevant state laws and federal regulations may arise depending on the nature of the data and the jurisdiction. Furthermore, the group is known for tactics involving the exploitation of VPN accounts, which suggests that vulnerabilities in the organization's network security processes may be present.

This situation also creates an indirect security risk for the organization's supply chain partners. In the manufacturing and construction sectors, interconnected business processes mean that a breach in one company can potentially impact the security posture of its partners. Organizations facing similar threats often focus on strengthening their network security, implementing robust multi-factor authentication to protect VPN access, and ensuring compliance with regulatory notification standards to mitigate the fallout from such incidents.