Studio VernaSocietà Professionale listed on Akira ransomware leak site

• Ransomware group: Akira
• Country: Italy
• Sector: Professional Services
• Announcement date: July 7, 2025

Akira ransomware group claims data breach at Studio VernaSocietà Professionale

The Akira ransomware group has listed the Italian professional services firm Studio VernaSocietà Professionale on its dedicated leak site. According to the announcement made on July 7, 2025, the threat actors claim to have successfully exfiltrated 7 GB of data from the organization's systems.

This incident follows a claimed attack date of May 14, 2025. While the listing has been made public on the group's platform, the specific details regarding the ransom demand remain unknown. The group has provided a torrent file and a magnet link to facilitate the downloading of the alleged stolen data.

Details of the alleged data exfiltration

The Akira ransomware group claims to have gained unauthorized access to the organization's financial and operational records. The group asserts that the stolen information is highly sensitive, though no screenshots were provided to verify the contents of the breach. The alleged data set is said to include various types of confidential information, such as:

• Financial audits
• Payment details
• Reports
• Invoices
• Client financial data
• Agreements
• Project information
• Employee information

The presence of such diverse data types suggests a significant breach of the organization's internal documentation and client-facing records.

Implications of the breach and security considerations

The breach of Studio VernaSocietà Professionale carries several significant risks. For the organization's clients and employees, the exposure of financial and personal information increases the risk of identity theft and fraud. Furthermore, because the organization operates within Italy, it may face legal obligations under the General Data Protection Regulation (GDPR) regarding the protection of personal data.

The Akira group appears to be employing a double extortion method. In such scenarios, threat actors do not merely encrypt an organization's data to demand a ransom for decryption; they also steal sensitive information and threaten to leak it publicly to increase pressure on the victim. This method often leads to the leaked data being utilized in secondary attacks, such as targeted phishing campaigns or further extortion attempts.

Additionally, given the organization's role in the professional services sector, the leaked data may pose risks regarding the exposure of trade secrets. Organizations in this sector should prioritize robust data protection strategies, including strict access controls, regular security audits, and comprehensive employee training to mitigate the risks of unauthorized access and subsequent data exfiltration.

General context on ransomware leak sites

Ransomware leak sites serve as a platform for threat actors to exert pressure on victims. By publishing stolen data, these groups attempt to damage the reputation of the target and coerce them into paying the ransom. The use of torrent files and magnet links allows for the decentralized distribution of stolen information, making it harder to remove the data once it has been leaked.