Lee & Sakahara Architects listed on killsec leak site following alleged data breach

• Ransomware group: killsec
• Country: United States
• Sector: Professional Services
• Announcement date: March 31, 2025

The architecture firm Lee & Sakahara Architects has been listed on the killsec ransomware leak site, facing allegations of a significant data breach. The threat actor group has claimed responsibility for the incident, placing the organization's name on their public platform as part of a pressure tactic common in modern cyber extortion campaigns.

The details of the claim

According to the announcement made on the killsec leak site, the group has listed data that allegedly belongs to Lee & Sakahara Architects. The group has initiated a countdown process, a method frequently used by ransomware operators to increase pressure on a victim by threatening the imminent publication of stolen information. This countdown serves as a psychological tool to force the target into negotiations.

The listing includes a messaging interface specifically designed for the institution's representatives. This feature is intended to facilitate direct communication, allowing the organization to initiate negotiations with the threat actors regarding the stolen data. Such mechanisms are a hallmark of double extortion tactics, where attackers not only encrypt systems but also threaten to leak sensitive information to damage the victim's reputation and operations.

Alleged data and file types

While the specific volume of data and the exact file counts have not been disclosed, the information provided in the leak site listing offers a glimpse into the nature of the alleged theft. Based on available screenshots, the files appear to consist of critical business assets. The contents identified in the listing include:

• Architectural project files
• Technical documentation

The presence of such files suggests that the breach may target the core intellectual property of the firm. In many ransomware scenarios, attackers target high-value documentation to maximize their leverage during extortion attempts.

About Lee & Sakahara Architects

Lee & Sakahara Architects is a professional services firm based in California. The company specializes in a wide range of architectural needs, including commercial, residential, and mixed-use projects. Their service portfolio focuses on providing comprehensive planning and design services for various types of developments.

Potential impact and industry risks

This incident may pose significant risks to the institution's intellectual property and trade secrets. The potential public disclosure of the alleged data could create a competitive disadvantage regarding the institution's projects, as proprietary designs and technical specifications are central to an architecture firm's market position. Furthermore, because the organization operates within the United States, the breach may trigger state-level data privacy regulations and lead to potential legal consequences.

If the breach involves employee or client information, secondary risks may emerge, such as identity theft and phishing attacks targeting the individuals involved. While information regarding the killsec group remains limited, the nature of the threat highlights the ongoing risks faced by professional service firms.

In general, organizations in the professional services sector can mitigate such risks by implementing robust defensive measures. These include maintaining offline backups of critical project files, enforcing multi-factor authentication across all remote access points, and conducting regular security awareness training to prevent initial access via phishing. Monitoring for unauthorized data exfiltration and maintaining a clear incident response plan are also essential components of a modern cybersecurity posture. As seen in this case, the threat of public disclosure remains a primary driver for ransomware groups targeting specialized firms.