Nvno law firm targeted by Akira ransomware group

• Ransomware group: Akira
• Country: United States
• Sector: Financial Services
• Announcement date: October 21, 2025

The Akira ransomware group has claimed responsibility for a data breach targeting Nvno, a law firm based in the United States. According to an announcement made on a leak site on October 21, 2025, the threat actor group alleges to have exfiltrated a significant volume of sensitive corporate and personal information belonging to the organization.

The alleged data breach event

The Akira ransomware group claims that the breach occurred around September 30, 2025. According to the group's announcement, they have successfully exfiltrated approximately 6 GB of data. This stolen information reportedly includes a mix of corporate records and highly sensitive personal data. The group has stated its intention to publish this stolen data on its dedicated leak site, a common tactic used by modern ransomware operators to pressure victims into paying ransoms.

This type of threat is characteristic of double-extortion tactics. In a double-extortion scenario, attackers do not merely encrypt an organization's files to disrupt operations; they also steal sensitive data beforehand. This allows the attackers to threaten the public release of the information if the ransom is not met, significantly increasing the pressure on the victimized organization. Such tactics are designed to maximize leverage by threatening the victim's reputation and legal standing.

Details of the claimed stolen data

The information allegedly stolen by the Akira group is extensive and contains highly sensitive identifiers. The group claims that the breach involves the personal details of at least 150 clients, alongside internal company records. While no screenshots have been provided by the attackers to verify the contents of the stolen files, the announcement specifies several categories of compromised information.

The data reportedly includes the following:

• Client identification data
• Passport numbers
• Social Security Numbers (SSNs)
• Driver's licenses
• Employee personal data
• Salary information
• Court case documents

The inclusion of such high-value identity documents, such as passports and Social Security Numbers, significantly elevates the severity of the alleged incident, as these are primary targets for identity theft and fraudulent activities.

About Nvno

Nvno, formally known as Napierski, VanDenburgh, Napierski & O'Connor, L.L.P., is a law firm located in Albany, New York. The firm specializes in various legal practice areas, including employment law, personal injury, and medical malpractice defense.

Implications and industry considerations

This alleged breach carries significant risks for the firm and its clients. For the clients, the exposure of identity documents like driver's licenses and Social Security Numbers increases the immediate risk of identity theft and financial fraud. For the law firm itself, the potential exposure of court case documents is particularly concerning, as it could compromise client confidentiality and lead to professional liability issues. Given that the firm operates within the United States, such an incident may trigger specific data breach notification requirements under various state laws and federal regulations.

The group's known modus operandi suggests that the exploitation of vulnerabilities in Virtual Private Networks (VPNs) may have been a factor in this incident. This highlights a common vector in modern cyberattacks, where attackers target remote access points to gain entry into a secure network.

For organizations in the legal and financial sectors, such incidents underscore the importance of robust defensive measures. Common industry practices to mitigate these risks include implementing multi-factor authentication (MFA) on all remote access points, such as VPNs, to prevent unauthorized entry through stolen credentials. Additionally, maintaining strict data encryption protocols for both data at rest and data in transit can help protect sensitive information even if a perimeter is breached. Regular security audits and vulnerability assessments are also essential for identifying and patching weaknesses before they can be exploited by ransomware groups.