Nadel Architects listed on Akira ransomware leak site

• Ransomware group: Akira
• Country: United States
• Sector: Professional Services
• Announcement date: December 8, 2025

Akira ransomware group claims Nadel Architects breach

The Akira ransomware group has listed Nadel Architects on its dedicated leak site, claiming to have successfully exfiltrated corporate data from the organization. According to the announcement, the threat actors allege they gained access to the firm's internal systems, leading to a significant data breach. This development follows a pattern of activity observed from the group, which has been active since early 2023.

The threat actors published their announcement on December 8, 2025. In the post, the group claims that the breach occurred around November 14, 2025. While the group has claimed responsibility for the intrusion, no specific ransom demand has been made public in the current listing. The Akira group is known for employing double extortion tactics, a method where attackers not only encrypt an organization's data but also threaten to leak sensitive information on public forums to increase pressure on the victim.

Details of the alleged data exfiltration

The Akira group alleges that they have stolen a substantial amount of information from Nadel Architects. The group claims to have exfiltrated approximately 472 GB of corporate data. Although the size of the data set has been specified, the total file count has not been provided by the threat actors. Furthermore, no screenshots were provided in the leak site announcement to verify the contents of the stolen data.

The information allegedly compromised during this incident includes a variety of sensitive documents and personal identifiers. The claimed data types include:

• Employee passport information
• Personal data
• Agreements
• Project files
• Financial documents
• Non-disclosure agreements

The presence of such diverse data types suggests a broad compromise of the organization's digital environment, ranging from administrative and human resources records to core business and project-related documentation.

About Nadel Architects

Nadel Architects is a professional services firm based in Los Angeles. The company has established a long-standing presence in the industry, having provided architectural design, planning, and urban design services for over 50 years. The firm is recognized for its specialized expertise in a variety of sectors, including commercial, residential, and mixed-use projects.

Potential impacts and security implications

This alleged breach poses several secondary risks to both the organization and the individuals involved. For the employees and clients of Nadel Architects, the exposure of personal data and passport information could lead to significant risks such as identity theft and the targeting of individuals through sophisticated phishing attacks. Such attacks often leverage stolen personal details to gain trust and deceive victims into revealing further sensitive information.

From a legal and regulatory perspective, the exposure of personal data can lead to serious consequences. In the United States, where Nadel Architects operates, the disclosure of such information may trigger legal actions and regulatory scrutiny under various state-level data protection laws. Furthermore, the use of double extortion by groups like Akira means that the public release of confidential project files and financial documents can cause lasting damage to an organization's commercial reputation. The disclosure of these files could also negatively impact the organization's supply chain and its relationships with various business partners.

In terms of technical defense, the Akira group has been known to target vulnerabilities within Virtual Private Networks (VPNs) to gain initial access to corporate networks. This highlights the importance for organizations to maintain rigorous network security processes. To mitigate such risks, organizations in the professional services sector often focus on securing remote access points, implementing multi-factor authentication, and conducting regular reviews of their network security posture to identify and patch vulnerabilities before they can be exploited by threat actors.