Morris Communications Company LLC targeted by Akira ransomware group

• Ransomware group: Akira
• Country: United States
• Sector: Technology
• Announcement date: November 3, 2025

Akira ransomware group claims data breach at Morris Communications Company LLC

The Akira ransomware group has listed a significant amount of data allegedly belonging to Morris Communications Company LLC on their dedicated leak site. According to the announcement made on November 3, 2025, the threat actors claim to have successfully compromised a dataset exceeding 84GB in size. This incident follows the established patterns of modern ransomware operations, where attackers move beyond simple encryption to focus on data exfiltration for extortion purposes.

Details of the alleged attack and claims

The Akira group published their announcement on November 3, 2025, claiming to have targeted Morris Communications Company LLC. The group alleges that it has compromised a dataset of over 84GB containing a mix of corporate and personal information. Following the exfiltration, the group has issued threats to either publish the stolen information or sell it to other malicious actors on the dark web.

Ransomware groups often utilize a tactic known as double extortion. In this scenario, the attackers do more than just lock a company out of its systems; they steal sensitive information beforehand. This provides them with additional leverage during negotiations, as they can threaten to leak the data publicly, causing reputational damage, regulatory scrutiny, and loss of customer trust, even if the company can restore its systems from backups.

Alleged compromised data types

While no screenshots were provided to verify the contents of the stolen files, the announcement specifies a wide range of sensitive information that has allegedly been compromised. The data is said to include:

• Financial data
• Employee personal data
• Customer personal data
• Medical records
• Identity documents

More specifically, the group claims the dataset contains financial audit reports, payment details, and invoices. Furthermore, the leaked information is alleged to include highly sensitive identity documents such as employee and customer passports, driver's licenses, and Social Security Numbers (SSN). The list also reportedly contains medical records, death/birth certificates, emails, and non-disclosure agreements (NDAs).

About Morris Communications Company LLC

Morris Communications Company is a privately held company with diversified holdings in media, real estate development, and agriculture. Founded in 2001, it is headquartered in Augusta, Georgia.

Potential impact and security implications

This incident may increase the risk of identity theft and fraud for the company's employees and customers due to the sensitive nature of the stolen identity documents and personal identifiers. The presence of highly sensitive information, such as medical records and Social Security Numbers (SSN), could expose the organization to significant legal liabilities under relevant regulations, including United States state laws and the Health Insurance Portability and Accountability Act (HIPAA).

The use of double-extortion tactics by the Akira group may lead to secondary risks and targeted phishing attacks if the data is eventually published. Furthermore, the company's supply chain partners may also be indirectly affected by this breach. Organizations in similar sectors often face increased scrutiny following such events, as the exposure of financial and personal data can disrupt business relationships and trust.

The Akira group, which emerged in early 2023, typically gains access to systems by exploiting vulnerabilities in Virtual Private Networks (VPNs). This highlights a common entry vector for many ransomware groups. To defend against such threats, organizations often need to review their network security processes, particularly regarding remote access points, and implement robust monitoring to detect unauthorized data exfiltration. Strengthening authentication measures and ensuring that all software, especially perimeter defenses, is regularly patched are standard defensive steps used to mitigate the risk of such breaches.