Mantis Creative listed on Akira ransomware leak site

• Ransomware group: Akira
• Country: United States
• Sector: Professional Services
• Announcement date: May 19, 2025

Akira ransomware group claims breach of Mantis Creative

The Akira ransomware group has listed Mantis Creative on its dedicated leak site. According to the announcement, which appeared on May 19, 2025, the threat actor group claims to have successfully executed a cyberattack against the organization, resulting in the alleged theft of a significant volume of corporate information.

The group claims to have obtained approximately 45 GB of data belonging to the organization. This alleged breach involves the unauthorized access and exfiltration of corporate documents, marking a significant potential security incident for the targeted entity. While the group has published this claim on their leak site, the information remains an allegation from the threat actor.

Details of the alleged data exfiltration

The announcement made by the Akira group suggests that the stolen information is quite diverse, encompassing various aspects of the company's internal operations. The group claims to have acquired a wide range of sensitive files that could impact the company's business relationships and internal administration. Specifically, the announcement mentions the inclusion of the following data types:

• Contracts
• Client data
• Project files
• Financial data

It is important to note that no screenshots or specific samples of the data were provided in the initial announcement to verify the claims. Furthermore, no specific ransom demand has been made public in the source information, and the exact date the initial intrusion occurred is claimed to be May 19, 2025.

About Mantis Creative

Mantis Creative is a North American agency that provides visualization and creative solutions for real estate projects and emerging brands. Formerly known as WCI Rally, the company specializes in architectural visualization and brand development. As a professional services firm, the company handles sensitive project details and client-facing documentation essential to its creative and architectural operations.

Impact assessment and cybersecurity implications

The alleged leak of this data may raise significant data privacy concerns for the organization's clients and business partners. The exposure of sensitive financial records and legal contracts could potentially damage the company's commercial reputation and may trigger legal proceedings. Because the organization is a US-based entity, it may face specific notification obligations under relevant state laws and federal data protection regulations regarding the exposure of sensitive information.

The Akira group is recognized as a Ransomware-as-a-Service (RaaS) group that has been active since early 2023. They are known for employing double extortion tactics, a method where attackers not only encrypt an organization's data but also threaten to leak it publicly to increase pressure for payment. This group frequently targets vulnerabilities in VPNs to gain initial access to networks.

For organizations in the professional services sector, such incidents highlight the ongoing risk of secondary attacks. If a breach occurs, the presence of similar vulnerabilities within other systems may remain, posing a continuous risk. To defend against such threats, organizations typically focus on robust patch management, particularly for remote access tools like VPNs, and implementing strict data access controls to mitigate the impact of potential exfiltration.