Molod Spitz & DeSantis listed on Akira ransomware leak site

• Ransomware group: Akira
• Country: United States
• Sector: Professional Services
• Announcement date: September 11, 2025

Akira ransomware group claims data breach at Molod Spitz & DeSantis

The Akira ransomware group has listed a significant amount of data allegedly belonging to the law firm Molod Spitz & DeSantis on their dedicated leak site. According to the announcement, the threat actors claim to have exfiltrated 62 GB of information from the organization's network. This development follows a pattern of double-extortion tactics frequently employed by modern ransomware operations.

Double-extortion is a sophisticated ransomware strategy where attackers do not merely encrypt an organization's files to demand a ransom for decryption. Instead, they also steal sensitive data before encryption and threaten to leak it publicly if the ransom is not paid. This method increases the pressure on victims, as the threat of exposing confidential information can cause irreparable reputational and legal damage, regardless of whether the organization can restore its systems from backups.

Details of the alleged intrusion

The threat actor behind the Akira group published an announcement on September 11, 2025, claiming responsibility for the breach. According to the group's claims, they successfully gained unauthorized access to the organization's network on September 10, 2025. The timeline suggests a rapid progression from the initial intrusion to the listing of data on the leak site.

While the group has signaled their intent to publish the stolen data to exert pressure on the firm, no screenshots of the data were provided in the announcement to verify the claims. The group's objective appears to be the use of this data as leverage in their extortion attempts. While the Akira group is known for exploiting vulnerabilities in VPNs to gain entry into networks, it remains unconfirmed if this specific entry vector was utilized in this instance.

Alleged contents of the leaked data

The information provided by the attackers suggests that the stolen data is highly sensitive, encompassing a wide range of legal, financial, and personal records. If the claims are accurate, the breach involves a vast array of confidential documentation. The allegedly leaked data includes:

• Employee documents
• Medical information
• Confidential agreements
• Customer information
• Finance and accounting files
• Contracts
• Police reports
• Investigation files
• Court hearing records

The presence of such diverse and sensitive information types highlights the potential impact of the breach on various stakeholders, including employees and clients of the firm.

About Molod Spitz & DeSantis

Molod Spitz & DeSantis is a law firm based in the United States. The firm specializes in defending clients in complex liability matters within the New York and New Jersey courts. It is recognized for its trial readiness and has established a strong track record of successful verdicts in its legal practice.

Risk assessment and organizational implications

The nature of the allegedly leaked data, which contains sensitive legal and personal information of clients, may pose a high risk. This situation could lead to the affected individuals being exposed to identity theft or targeted phishing attacks. For a US-based law firm, a breach of this magnitude may potentially result in legal repercussions under HIPAA or state-level data protection regulations.

The use of the double-extortion method by the Akira group could cause significant reputational damage and operational disruptions for the organization. In the professional services sector, maintaining client confidentiality is a cornerstone of business operations, and the exposure of such data can undermine trust and lead to long-term consequences.

To defend against such threats, organizations in the professional services sector often implement multi-layered security strategies. This includes robust access controls, regular security awareness training for employees, and the implementation of multi-factor authentication (MFA) across all remote access points, such as VPNs. Continuous monitoring of network traffic and maintaining offline, immutable backups are also critical defensive steps to mitigate the impact of ransomware and data exfiltration events.