Kramer Green Zuckerman Greene and Buchsbaum targeted by Akira ransomware group

• Ransomware group: Akira
• Country: United States
• Sector: Professional Services
• Announcement date: April 28, 2025

Akira ransomware group claims data breach at law firm

The Akira ransomware group has issued an announcement on its leak site claiming to have compromised the data of Kramer Green Zuckerman Greene and Buchsbaum. According to the claim made on April 28, 2025, the threat actors assert that they have successfully exfiltrated a significant amount of information belonging to the firm.

The incident involves a claim of a large-scale data leak. The Akira ransomware group states that it intends to publish the stolen information, which is allegedly in the possession of the group. This type of threat is a hallmark of modern ransomware operations, where the goal is not just to encrypt systems but to leverage sensitive information to force a payment.

Details of the alleged data theft

The threat actors claim that the volume of stolen data exceeds 80 GB. While the group has made this announcement, no screenshots were provided to verify the contents of the stolen files. The group suggests that the stolen information includes various types of operational and confidential documents belonging to the organization.

The specific types of data allegedly compromised include:

• Employee personal data
• Client personal data
• Financial data
• Non-disclosure agreements
• Court records

The presence of such diverse data types suggests that the breach could impact various aspects of the firm's operations and the privacy of both its staff and its clientele.

About Kramer Green Zuckerman Greene and Buchsbaum

Kramer, Green, Zuckerman, Greene & Buchsbaum, PA is a law firm based in Hollywood, Florida. The firm specializes in several key legal areas, including asset protection, estate planning, corporate law, and business transactions.

Implications and industry context

This incident highlights a growing trend where professional services, particularly law firms, are targeted by cybercriminals. Such organizations are highly attractive to threat actors due to the sensitive and confidential nature of the client data they manage. The potential publication of the alleged data could significantly increase the risk of identity theft and fraud for the affected clients.

The tactics used by the Akira group appear to follow the double extortion method. In this scenario, attackers not only encrypt an organization's data to disrupt operations but also threaten to leak the stolen information on a public leak site. This method is designed to maximize pressure on the victim, using the threat of reputational damage and legal consequences as leverage to demand a ransom.

For a firm in this position, the consequences can be multifaceted. Beyond the immediate operational disruption, the organization may face legal consequences under US state laws and relevant data protection regulations. To manage such a crisis, organizations typically need to conduct a thorough forensic investigation to determine the full scope of the breach and fulfill their obligations to notify the affected parties.

In general, organizations in the professional services sector can mitigate these risks by implementing robust security frameworks. This includes maintaining strict access controls, conducting regular security audits, and ensuring that sensitive client information is encrypted both at rest and in transit. Furthermore, developing a comprehensive incident response plan is essential for managing the legal and reputational fallout that follows a confirmed data breach.