Pine Pharmaceuticals listed on Akira ransomware leak site

• Ransomware group: akira
• Country: United States
• Sector: Healthcare
• Announcement date: November 5, 2025

Akira ransomware group claims breach of Pine Pharmaceuticals

The healthcare organization Pine Pharmaceuticals has been listed on the leak site of the Akira ransomware group. According to the announcement made on November 5, 2025, the threat actors claim to have targeted the organization, alleging that they have successfully exfiltrated a significant amount of sensitive information. This listing follows a claimed attack date of October 3, 2025.

The Akira group has announced their intention to publish 18 GB of data that they allege belongs to Pine Pharmaceuticals. The group claims that both corporate documents and sensitive personal information have been compromised during the incident. By listing these files on their dedicated leak site, the group appears to be employing a double extortion strategy. In such scenarios, ransomware actors do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive data to use as leverage, threatening to release it publicly unless a ransom is paid. This approach increases the pressure on the victim organization by threatening their reputation and regulatory standing.

Claimed data contents and affected information

The announcement provides specific details regarding the types of information the group claims to have stolen. While no screenshots were provided to verify the contents of the stolen files, the group has identified several categories of highly sensitive data. The compromised information reportedly includes a wide range of identity documents and corporate records.

The data allegedly involved in this breach includes the following:

• Employee HR data
• Customer information
• Financial records
• Identity documents

More specifically, the group claims the stolen data contains employee I-9 forms, Social Security Numbers (SSN), driver's licenses, passports, birth/death certificates, customer information, project details, financial records, and NDAs. No information was provided regarding the specific file count or the amount of a ransom demand.

About Pine Pharmaceuticals

Pine Pharmaceuticals is a 503B outsourcing facility that specializes in the preparation of high-quality, ready-to-administer compounds and repackaged products. Based in New York, USA, the company provides pharmaceutical compounding services for the healthcare industry.

Risk assessment and implications for the healthcare sector

This alleged breach may increase the risk of identity theft for the organization's employees and customers due to the sensitive nature of the documents mentioned. As a healthcare entity, the compromised data could fall under regulations such as HIPAA, potentially leading to regulatory scrutiny and legal consequences for the organization.

The double extortion method employed by the Akira group may facilitate secondary phishing attacks once the data is released. When sensitive personal information such as Social Security Numbers or identity documents are leaked, attackers often use that information to craft highly convincing fraudulent communications to target the individuals involved. Furthermore, the organization's supply chain partners could also be indirectly affected by this incident.

Given the group's history of exploiting VPN vulnerabilities, it may be advisable for organizations to review their network security protocols. Generally, organizations in the healthcare sector can mitigate such risks by implementing robust multi-factor authentication, maintaining strict access controls, and ensuring that all remote access points, such as VPNs, are fully patched and monitored for unusual activity. Regular security audits and comprehensive data encryption strategies are also vital defensive steps in protecting sensitive patient and corporate information from exfiltration.