Land Planners targeted by Akira ransomware group

• Ransomware group: Akira
• Country: United States
• Sector: Professional Services
• Announcement date: March 20, 2025

Akira ransomware group claims data breach at Land Planners

The Akira ransomware group has listed data they claim belongs to Land Planners on their dedicated leak site. According to the announcement made on March 20, 2025, the group asserts that they have successfully exfiltrated a significant amount of information from the organization. This claim comes as part of the group's ongoing operations involving data extortion.

The group alleges that the stolen data consists of essential corporate documents. It is important to note that the group has not provided any screenshots to verify the authenticity of the files. Consequently, the current understanding of the breach's content relies solely on the claims made by the threat actors on their leak site.

Details of the claimed data leak

The Akira ransomware group claims to have accessed and leaked 13 GB of data. While the total file count has not been specified, the volume of data suggests a substantial breach of corporate information. The contents of the leak, as described by the attackers, may include a wide variety of sensitive documents that could impact both the organization and its stakeholders.

According to the group's claims, the following types of information may have been compromised:

• Employee contact information
• Customer contact information
• Passport details
• Social Security Numbers (SSN)
• Employment authorizations
• Driver licenses
• HR documents
• Financial data

Because no screenshots were provided by the group, the presence of these specific data types remains unverified and rests entirely on the group's assertions.

About Land Planners

Land Planners PC is a professional services firm based in Georgia, United States. The company specializes in the architecture, engineering, and design sectors. Specifically, Land Planners PC provides a range of land planning and design services to its clients.

Risk assessment and implications of the incident

This incident may pose a significant risk of identity theft for the organization's employees and customers. The leaked data, which reportedly includes highly sensitive information such as Social Security Numbers (SSN) and passport details, could be considered high-risk under various data protection regulations. For an organization based in the United States, such a breach may trigger specific data breach notification obligations under both state laws and federal regulations.

The Akira group is known for employing a double-extortion method. In this tactic, attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release. The publication of this data could create a foundation for secondary attacks, such as targeted phishing attempts or further extortion efforts against the organization.

While public information regarding the Akira group remains limited, it has been reported in the past that the group has exploited vulnerabilities in VPNs to gain initial access to networks. This highlights the importance of robust perimeter security and continuous monitoring.

For organizations operating in the professional services sector, such incidents underscore the necessity of implementing comprehensive security frameworks. This includes maintaining strict access controls, implementing multi-factor authentication, and ensuring that all remote access points, such as VPNs, are fully patched and secured against known vulnerabilities. Additionally, regular data encryption and employee awareness training regarding phishing can serve as critical defensive layers against the types of secondary attacks often seen in double-extortion scenarios.