Rosland Capital targeted by Akira ransomware group

• Ransomware group: Akira
• Country: United States
• Sector: Financial Services
• Announcement date: December 5, 2025

The Akira ransomware group has claimed to have compromised data belonging to the financial services firm Rosland Capital. According to an announcement made on a leak site, the group has listed data allegedly belonging to the organization, marking a potential significant breach for the firm.

The details of the claim

The Akira ransomware group has listed data allegedly belonging to Rosland Capital on its leak site. The group claims to possess corporate data, projects, and client information that may be published. This announcement was made on December 5, 2025. The group is known to employ double-extortion tactics, a method where attackers not only encrypt an organization's data but also steal sensitive information to threaten its public release if a ransom is not paid.

In a double-extortion scenario, the threat actor leverages the sensitivity of the stolen data to increase pressure on the victim. This tactic is common among modern ransomware groups and aims to ensure payment by threatening the reputational and legal consequences of a data leak. While the group has made these claims, the specific content of the stolen files cannot be verified at this time because no screenshots were provided with the announcement.

Data allegedly involved in the breach

The announcement mentions that the data includes various types of sensitive information. While the specific content remains unverified due to the lack of visual evidence, the group claims the following types of information are involved:

• Corporate data
• Client data

The group specifically mentions that the stolen files may include corporate projects and confidential information. The lack of specific file counts or a defined data size in the public announcement means the full scope of the breach remains unclear.

About Rosland Capital

Rosland Capital is a financial services firm that specializes in the sale and asset management of gold and other precious metals in physical form. The company provides services to investors for building precious metal portfolios.

Analysis and implications

This incident suggests that sensitive financial information belonging to the firm's clients could be at risk of exposure. The double-extortion tactic employed by the Akira group may lead to significant reputational damage and legal consequences for the organization if the data is released. Given that the institution is based in the United States, the incident may fall under the scope of various state laws and federal data protection regulations.

Furthermore, the compromised data could potentially be utilized for identity theft or targeted phishing campaigns. Such campaigns often follow data breaches, where attackers use stolen client information to craft highly convincing fraudulent communications to further exploit victims.

Public information regarding the Akira group indicates that they have been active since early 2023 and may leverage VPN vulnerabilities to gain unauthorized access to target networks. For organizations in the financial services sector, such incidents highlight the importance of securing remote access points and maintaining robust monitoring to detect unauthorized entry attempts.