Shands Elbert listed on Akira ransomware leak site

• Ransomware group: akira
• Country: United States
• Sector: Professional Services
• Announcement date: November 7, 2025

Shands Elbert targeted by Akira ransomware group

The law firm Shands Elbert has been listed on the Akira ransomware group's leak site. The threat actors claim to have successfully exfiltrated corporate and personal data belonging to the firm, marking a significant potential breach for the professional services provider.

Details of the alleged data exfiltration

According to an announcement posted by the Akira group on November 7, 2025, the attackers claim to have stolen over 31 GB of data from Shands Elbert. The group alleges that the attack occurred around October 16, 2025. In their communication, the threat actors claim that the law firm failed to adequately protect the personal information of its clients. The group has stated that the stolen data is scheduled to be published on their leak site in the near future.

While no screenshot has been provided to verify the contents of the breach, the group claims the stolen information is highly sensitive. The alleged data includes a wide variety of personal, legal, and financial records, specifically:

• Names
• Dates of birth
• Phone numbers
• Addresses
• Driver's licenses
• Passports
• Social Security Numbers (SSN)
• Medical files
• Financial records
• Confidential documents
• Court hearing transcripts
• Police reports

About Shands Elbert

Shands, Elbert, Gianoulakis & Giljum, LLP is a law firm based in St. Louis with over 50 years of experience. The firm provides legal services in areas such as business law, education law, labor and employment, litigation, and estate planning to corporate and individual clients.

Risk assessment and industry implications

This leak claim may pose a significant risk of exposing sensitive personal and financial data belonging to the law firm's clients. The presence of Social Security Numbers and medical records in the alleged breach could increase the likelihood of affected individuals being targeted by identity theft and fraud. Given that the institution is based in the United States, this incident may lead to legal repercussions under HIPAA or state-level data protection regulations.

The Akira group, which emerged in early 2023, is known to frequently gain network access by exploiting VPN vulnerabilities before encrypting and exfiltrating corporate data. This incident highlights the use of double-extortion tactics, a method where attackers not only encrypt a victim's data but also threaten to leak it to pressure the organization into paying a ransom. When such tactics are used, the firm may face significant reputational damage in addition to operational disruptions.

For organizations in the professional services sector, particularly law firms handling sensitive client information, these types of threats underscore the necessity of robust cybersecurity postures. Defensive strategies often include securing remote access points, such as VPNs, through multi-factor authentication and regular vulnerability patching. Furthermore, implementing strict data loss prevention measures and encryption for sensitive client files can help mitigate the impact of an exfiltration event. As threat actors continue to target high-value data repositories, maintaining comprehensive monitoring and incident response plans remains a critical component of organizational resilience.