Rusin Law targeted by Akira ransomware group in alleged data breach

• Ransomware group: Akira
• Country: United States
• Sector: Professional Services
• Announcement date: August 14, 2025

Akira ransomware group claims data breach at Rusin Law

The Akira ransomware group has listed a significant amount of data allegedly belonging to Rusin Law on its dedicated leak site. According to an announcement made by the threat actors, the stolen dataset is claimed to be approximately 134 GB in size. This development follows a pattern often seen in modern cyberattacks where threat actors use public leak sites to pressure victims into meeting ransom demands.

The announcement regarding this incident was published on August 14, 2025. While the group has posted the claim online, the actual contents of the breach have not been independently verified. Such listings are a common tactic used by ransomware groups to increase pressure on organizations by threatening to release sensitive information to the public if specific conditions are not met.

Details of the alleged attack and stolen data

The Akira group claims to have successfully obtained data belonging to Rusin Law. According to the group's announcement, the initial breach or data acquisition is alleged to have occurred on July 21, 2025. The threat actors have threatened to publish the entirety of the 134 GB dataset, which they claim contains a wide variety of sensitive information belonging to the firm.

The information allegedly contained within the leaked dataset is extensive and covers multiple sensitive categories. Based on the group's claims, the stolen data includes:

• Financial records, such as audit reports, payment details, and invoices
• Employee personal information
• Customer personal information
• Medical information
• Legal documents, including police protocols and court hearing documents

It is important to note that the group has not provided any screenshots to support their claims regarding the contents of the data. Furthermore, no specific ransom demand has been disclosed in the public announcement.

About Rusin Law

Rusin Law is a professional services firm based in the United States. The organization specializes in civil litigation defense, with a primary focus on handling workers' compensation cases. In addition to this specialization, the firm provides legal services across various other disciplines, including employment law and insurance defense.

Potential implications and industry risks

If the claims made by the Akira group are verified, the breach could lead to significant risks for both the firm's employees and its clients. The exposure of personal data, such as birth certificates and medical information, creates a high risk of identity theft and financial fraud for the individuals involved. For a law firm, the exposure of such sensitive documentation could have severe negative impacts on organizational confidentiality and the fundamental principle of attorney-client privilege.

The use of a double-extortion method is a hallmark of the Akira group. In these scenarios, attackers do not just encrypt systems to disrupt operations; they also steal sensitive data to use as leverage. By threatening to release private information, the attackers aim to damage the organization's reputation and create secondary pressures that go beyond simple operational downtime. Such leaks can lead to long-term reputational damage and may trigger secondary attacks against the victims.

From a regulatory perspective, a breach of this nature involving personal and medical information may trigger data breach notification obligations under United States laws and relevant state-level regulations. Organizations in the professional services and legal sectors often face these challenges, necessitating robust security postures to protect client confidentiality. General defensive strategies for organizations facing such threats typically include maintaining strict access controls, implementing comprehensive encryption for data at rest and in transit, and ensuring regular, offline backups are maintained to mitigate the impact of encryption-based attacks.