Treetop Companies targeted by Akira ransomware group

• Ransomware group: Akira
• Country: United States
• Sector: Financial Services
• Announcement date: November 12, 2025

Akira ransomware group claims data breach at Treetop Companies

The Akira ransomware group has announced a data breach involving Treetop Companies, a firm operating within the financial services sector. According to an announcement posted on a leak site on November 12, 2025, the threat actors claim to have successfully compromised the organization and exfiltrated a significant volume of corporate information.

The incident was allegedly carried out on November 11, 2025. The threat actors claim to have stolen approximately 100 GB of data belonging to the organization. While the group has stated that the stolen information will be published in the near future, no specific ransom demand has been disclosed in the announcement. Furthermore, no screenshots of the stolen data have been provided to verify the claims at this time.

Details of the claimed data exfiltration

The Akira ransomware group alleges that the stolen data contains a wide variety of sensitive corporate and personal documents. The contents of the breach, as claimed by the attackers, include highly sensitive information that could be used for various malicious purposes. The specific types of data mentioned in the leak site announcement include:

• Passports
• Driver's licenses
• Financial records
• Client personal data
• Non-disclosure agreements

The presence of such sensitive identification documents and financial records highlights the potential severity of the alleged breach. In many ransomware attacks, the theft of such data is used as leverage in double-extortion schemes, where attackers threaten to release information to pressure the victim into paying a ransom.

About Treetop Companies

Treetop Companies is a real estate investment and management firm. The company was founded in 2005 by Azi Mandel and Adam Mermelstein. The firm focuses its operations on managing and investing in both residential and commercial real estate portfolios.

Analysis and potential impact of the incident

This alleged data breach poses significant risks to both the organization and the individuals whose information may have been compromised. The exposure of sensitive documents such as passports, driver's licenses, and client personal data may pose a high risk of identity theft for the firm's clients and employees. Additionally, the exposure of financial records could impact the firm's reputation and potentially trigger compliance processes under various US state data protection laws.

The Akira group is known for employing double-extortion tactics. In these scenarios, attackers not only encrypt the victim's systems but also steal sensitive data, threatening to leak it publicly to maximize their leverage. Consequently, the publication of this data could lead to secondary attacks and targeted phishing campaigns against the firm or its stakeholders.

Historically, the Akira group has been known to exploit vulnerabilities in Virtual Private Networks (VPNs) to gain initial access to networks. This highlights the importance of robust network security and regular reassessment of perimeter defenses. For organizations in the financial services sector, maintaining strict access controls and monitoring for unauthorized exfiltration is critical. While information regarding this specific group remains limited, the nature of the claimed theft suggests a high level of intent to cause disruption and reputational damage.