Rhodes Young Black & Duncan RYBD allegedly targeted by Akira ransomware group

• Ransomware group: Akira
• Country: United States
• Sector: Professional Services
• Announcement date: November 11, 2025

Akira ransomware group claims data breach at Rhodes Young Black & Duncan

The professional services firm Rhodes Young Black & Duncan has been listed on a ransomware leak site, with the Akira ransomware group claiming responsibility for a data breach. According to the announcement made on November 11, 2025, the threat actors assert that they have successfully exfiltrated various corporate documents and a significant amount of personal information belonging to the firm.

The claim suggests that the breach occurred around October 5, 2025. While the group has posted the organization's name on its leak site, no specific information was provided regarding the total size of the stolen data, the exact file count, or the specific ransom demand. The threat actor has stated that the acquired files are intended for publication in the near future.

Details of the alleged data theft

The information allegedly stolen by the Akira group is extensive and covers multiple sensitive categories. The threat actor claims to have obtained a variety of corporate documents and highly sensitive personal information belonging to clients and staff. According to the group's claims, the leaked data may include the following items:

• Passports
• Driver's licenses
• Social Security Numbers (SSN)
• Medical information
• HR records
• Financial data
• Agreements

In addition to the list above, the group claims to have acquired project files, contracts, and certain documents related to military matters. It is important to note that no screenshots were provided by the group to verify the contents of the alleged breach.

About Rhodes Young Black & Duncan

Rhodes Young Black & Duncan is a professional services firm located in Duluth. The company operates as a CPA and business consulting firm, providing a wide range of comprehensive services including tax, accounting, and corporate consulting to its clients.

Potential risks and organizational implications

This alleged breach poses significant secondary risks to both the firm's employees and its client base. The potential exposure of Social Security Numbers and medical information increases the risk of identity theft and makes individuals targets for highly specific, targeted phishing attacks. Furthermore, the presence of such sensitive data under US data protection laws and various state regulations could lead to serious legal and regulatory consequences for the organization.

The Akira group is known for employing double-extortion tactics. In these scenarios, attackers do not just encrypt a network but also steal sensitive data, threatening to publish it publicly to increase pressure on the victim. Such tactics can cause long-term damage to a firm's commercial reputation and lead to a profound loss of trust due to privacy violations. The group has a known history of preferring to exploit VPN accounts, which may suggest that vulnerabilities in network security or remote access protocols could be a primary entry point for such attacks.

For organizations operating in the professional services sector, maintaining robust security postures is critical. This typically involves implementing multi-factor authentication, particularly for VPNs and remote access points, to mitigate the risk of credential exploitation. Regular security audits, comprehensive employee training to recognize phishing attempts, and strict data encryption protocols are standard defensive measures used to protect sensitive client and corporate information from unauthorized access and exfiltration.