Stoss Landscape Urbanism targeted by Akira ransomware group

• Ransomware group: Akira
• Country: Spain
• Sector: Professional Services
• Announcement date: November 19, 2025

Akira ransomware group claims data breach at Stoss Landscape Urbanism

The Akira ransomware group has announced that it has allegedly exfiltrated 76 GB of data belonging to Stoss Landscape Urbanism. This claim was made via a leak-site announcement on November 19, 2025, marking a significant potential breach for the organization.

Details of the alleged attack

In an announcement published on November 19, 2025, the Akira group claims to have compromised the systems of Stoss Landscape Urbanism. The group asserts that it has obtained 76 GB of data from the organization. This disclosure, which includes threats to publish the information, aligns with the group's known double-extortion tactics.

Double-extortion is a common methodology used by modern ransomware groups. In this tactic, attackers do not merely encrypt a victim's files to disrupt operations; they also steal sensitive information before the encryption process begins. The threat of leaking this stolen data on a public leak site serves as additional leverage to pressure the victim into paying the ransom. By threatening to release private information, the attackers aim to maximize the psychological and reputational impact on the target organization.

Data types involved in the claim

The announcement states that the data includes a variety of sensitive documents and personal identifiers. While no screenshot has been provided to verify the contents of the stolen files, the group claims the following information is part of the breach:

• Passport information
• Social Security Numbers
• Email addresses
• Phone numbers
• Non-disclosure agreements
• Personal information

The inclusion of such highly sensitive personal identifiers suggests a significant breach of privacy for the individuals involved.

About Stoss Landscape Urbanism

Stoss Landscape Urbanism is a design firm specializing in designing landscapes and social spaces that promote resilience, vitality, and equity. They work on various projects including downtown plazas, parks, waterfronts, and mixed-use residential areas.

Potential impact and risks

This alleged breach may pose secondary risks such as identity theft and targeted phishing attacks for the organization's employees and customers. Given that the institution operates in Spain, the leaked data could be subject to GDPR regulations, potentially leading to legal consequences. Furthermore, the exposure of non-disclosure agreements could create long-term operational risks for the institution's business partners and ongoing projects. The incident may negatively impact the organization's commercial reputation and customer trust.

Considering Akira's history of exploiting VPN vulnerabilities for network access, it is possible that the organization's cybersecurity infrastructure may have contained exploitable weaknesses. Organizations in the professional services sector often face similar risks, where the theft of proprietary project details or client information can undermine business relationships.

To defend against such threats, organizations typically focus on hardening their perimeter, particularly regarding remote access tools. Implementing multi-factor authentication (MFA) on all external-facing services, such as VPNs, is a standard defensive measure. Additionally, maintaining strict network segmentation can help prevent attackers from moving laterally through a network to reach sensitive data stores. Regular monitoring of network traffic for unusual data exfiltration patterns and ensuring robust encryption for data at rest and in transit are also critical components of a modern cybersecurity posture.