iGlobal Services and Medenet listed on Akira ransomware leak site

• Ransomware group: Akira
• Sector: Healthcare
• Announcement date: January 29, 2026

Akira ransomware group claims data breach at iGlobal Services and Medenet

The Akira ransomware group has officially listed iGlobal Services and Medenet on its dedicated leak site. In an announcement made on January 29, 2026, the threat actor group claimed to have successfully executed a data breach against these two entities. While the listing serves as a claim by the ransomware group, it highlights a significant potential security incident involving sensitive information within the healthcare sector.

The group has asserted that they intend to publish a dataset containing corporate information in the near future. According to the claims made by the threat actor, the volume of the compromised data is approximately 24 GB. This announcement follows the group's pattern of targeting organizations and subsequently threatening to release stolen information to exert pressure on the victims.

Details of the alleged data theft

The threat actor has provided specific details regarding the types of information they claim to have exfiltrated from the targeted organizations. Although no screenshots were provided in the announcement to verify the contents of the stolen files, the group has listed a wide variety of sensitive documents and personal identifiers. The nature of this data suggests a high level of sensitivity for both the organizations and the individuals involved.

The data types allegedly compromised include:

• Employee data
• Customer data
• Passport information
• Social Security Numbers (SSN)
• Financial documents
• Contracts
• Non-Disclosure Agreements (NDA)

The inclusion of such diverse data types—ranging from identity documents like passports and Social Security Numbers to legal documents like contracts and Non-Disclosure Agreements—indicates that the breach, if verified, could have widespread implications for identity security and corporate confidentiality.

The implications of the Akira ransomware group's tactics

The Akira group is known to employ double-extortion tactics in their operations. In a double-extortion scheme, threat actors do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive data before the encryption occurs. This allows them to threaten the victim with the public release of the stolen information, creating a secondary layer of pressure to ensure payment. This method is particularly effective against organizations that can recover from backups but cannot afford the reputational or legal fallout of a public data leak.

Public information regarding the specific technical methods or the full scope of the Akira group's operations remains limited. However, their ability to target specific sectors and claim large volumes of data is a characteristic common among sophisticated ransomware operations. The use of leak sites serves as a public billboard for these groups, intended to maximize the visibility of the breach and increase the likelihood of successful extortion.

Risks and necessary responses in the healthcare sector

This incident may pose a significant risk of exposing sensitive personal and financial information belonging to the organizations. The nature of the alleged data, particularly the inclusion of Social Security Numbers and passport information, could lead to identity theft or targeted phishing attacks against employees and customers. Such attacks often use the stolen information to build trust with the victim, making the fraudulent communications appear legitimate.

For organizations operating in the healthcare sector, such a breach may trigger complex administrative and legal processes under relevant data protection regulations. The sensitivity of healthcare-related corporate and personal data means that regulatory bodies often require strict notification protocols when a breach is suspected or confirmed. Given the Akira group's known double-extortion tactics, it is possible that the organizations may face secondary extortion pressure following the initial attack.

In response to such incidents, organizations typically need to review their network security and initiate notification processes for the affected parties. Strengthening defensive postures involves implementing robust monitoring, ensuring comprehensive encryption of data at rest and in transit, and maintaining rigorous access controls to mitigate the risk of unauthorized data exfiltration. Furthermore, organizations must be prepared to manage the legal and reputational consequences that follow the exposure of sensitive personal and corporate documentation.