MerchNOW listed on Akira ransomware leak site

• Ransomware group: Akira
• Country: United States
• Sector: Retail & E-Commerce
• Announcement date: March 31, 2026

Akira ransomware group claims MerchNOW data breach

The Akira ransomware group has listed the music merchandising company MerchNOW on its dedicated leak site. According to the announcement made on March 31, 2026, the threat actors claim to have successfully compromised the organization's systems and are currently in possession of various types of corporate data. While the group has not yet released the stolen information, they have stated that they intend to upload the data to their platform shortly.

The threat actor's announcement suggests a targeted operation aimed at extracting sensitive information from the company. In such scenarios, ransomware groups often employ a double-extortion tactic. This method involves not only encrypting an organization's local files to disrupt operations but also exfiltrating sensitive data to use as leverage. By threatening to leak the stolen information on a public leak site, the attackers attempt to pressure the victim into paying a ransom to prevent the exposure of confidential records.

Details of the claimed data theft

The Akira group alleges that the compromised information includes a wide range of sensitive documents belonging to both the company and its employees. The threat actor claims that the stolen data contains highly personal and confidential files that could be used for malicious purposes. Although the group has not provided any screenshots to verify the contents of the stolen data, they have specified the categories of information they claim to hold.

The specific types of data mentioned in the claim include:

• Employee passports
• Driver's licenses
• Social Security Numbers (SSNs)
• Financial documents
• Contracts
• Non-disclosure agreements (NDAs)
• Project files

The breadth of this alleged data theft suggests a significant breach of privacy and corporate confidentiality. The inclusion of identity documents and government-issued identifiers poses a severe risk to the individuals involved, while the presence of legal and project-related files impacts the company's internal operations.

About MerchNOW

MerchNOW is a music merchandising company that specializes in the design, production, and distribution of custom products for bands and artists. The company provides a comprehensive suite of services, including screen printing, embroidery, and fulfillment. With over 20 years of experience in the industry, MerchNOW produces a variety of items such as apparel, accessories, and vinyl records for its clients.

Potential impact and security implications

The claims made by the Akira group carry significant implications for both the organization and its employees. If the alleged data is indeed leaked, employees could face a substantial risk of identity theft due to the exposure of sensitive personal identifiers like passports, driver's licenses, and Social Security Numbers. Furthermore, the exposure of corporate financial and legal documents, such as contracts and non-disclosure agreements, could lead to the loss of trade secrets and potentially result in breaches of agreements with third-party partners.

Because MerchNOW is located in the United States, the company may be subject to various federal regulations and state-level data breach notification laws depending on the nature of the data and the residency of the affected individuals. Additionally, the leaked information could potentially be utilized by threat actors to facilitate highly targeted phishing campaigns against the company or its clients.

Akira is a known ransomware group that frequently exploits vulnerabilities in Virtual Private Networks (VPNs) to gain initial access to corporate networks. This highlights the ongoing importance of robust perimeter security and the implementation of multi-factor authentication (MFA) on all remote access points. For organizations in the retail and e-commerce sectors, maintaining strict data governance and implementing comprehensive monitoring can help mitigate the risks associated with such targeted attacks.