Akantha Listed by blacklock Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On December 23, 2024, the French legal-software firm Akantha appeared on a listing associated with the blacklock ransomware group. Public detail confirms only that the group claims to have exfiltrated internal files in a ransomware attack; the number of people affected remains unknown, and no further technical specifics have been released.

Because Akantha supplies Portalis, a practice-management platform used by law firms, any compromise of its systems raises questions about the confidentiality of legal work product and client-related material that such software typically processes. At this stage the claim itself is the primary public record.

Inside the incident

The available record states that Akantha was listed by blacklock and that internal files were exfiltrated during a ransomware attack. The date of the listing is given as December 23, 2024. No information has been disclosed about the initial access method, the duration of any intrusion, the volume of data taken, or whether encryption of production systems occurred. The number of individuals whose information may have been involved is listed as unknown. Public reporting therefore rests solely on the group’s claim that internal files left the organisation.

The group behind it: blacklock

Blacklock is a ransomware operation that has appeared on public leak sites in recent years. Like many such groups, it typically claims to steal data before encrypting systems and then posts victim names on a dedicated site to pressure payment. Established public reporting describes blacklock as following the common double-extortion model: data theft combined with the threat of publication. The group has previously listed organisations across multiple sectors and geographies. In the present case the only specific assertion is the listing of Akantha itself; no additional statements attributed to blacklock about this victim have entered the public record beyond the claim of internal-file exfiltration.

Who is Akantha?

Akantha is a small French software company with fewer than 25 employees and reported revenue under five million dollars. Its principal product is Portalis, a legal-practice management suite designed for lawyers and law firms. The platform offers role-specific dashboards, a 360-degree client and matter view, automatic updates, secure document sharing, and data hosting inside France. Akantha regularly presents Portalis at Barreau events, positioning the tool as a means of streamlining legal procedure management. Organisations of this type routinely handle matter files, calendars, billing records, and correspondence that may contain privileged or personally identifiable information belonging to both lawyers and their clients. A breach at such a provider therefore carries potential consequences for the confidentiality of legal work even when the precise contents of any stolen files remain unconfirmed.

What was likely exposed

The facts name only “internal files” as having been exfiltrated. No inventory of file types, databases, or individual records has been published. Organisations that develop and host legal software commonly store source code, configuration data, customer account details, support tickets, and, depending on architecture, copies or metadata of documents uploaded by law-firm users. Because the exact contents are unconfirmed, the following points summarise what is known and what remains open:

• Confirmed claim: internal files were taken in a ransomware attack.
• Unconfirmed: any specific categories such as client names, case documents, credentials, or financial records.
• Unconfirmed: whether production customer data hosted in France was among the material.
• Unconfirmed: total volume or number of affected individuals.

Until further disclosure occurs, any assertion about particular data elements would be speculative.

The real-world impact

For individuals whose information may have been present in the internal files, the principal risks are identity misuse, targeted phishing that references legitimate legal matters, and potential exposure of sensitive personal or professional details. Lawyers and firm staff whose credentials or correspondence appear in the material could face account-takeover attempts or reputational harm if privileged content surfaces. For Akantha itself, the incident creates operational disruption, possible regulatory scrutiny under French and European data-protection rules, and the need to notify customers if any client data proves to have been involved. Because the company is small, recovery resources may be limited, prolonging uncertainty for users of Portalis. No public confirmation of ransom payment, data publication, or remediation steps has yet appeared.

Were you affected?

If you are a lawyer, firm administrator, or client who has used Portalis or otherwise interacted with Akantha, treat the listing as a prompt to review account security. Change passwords associated with the service, enable multi-factor authentication where available, and monitor financial and email accounts for unusual activity. Watch for phishing messages that reference legal matters or the company name. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets. Official updates, if any, will come from Akantha or competent authorities; until then, the public record remains limited to the blacklock claim of internal-file exfiltration reported on December 23, 2024.

AICompiled with AI assistance from public sources and published under our editorial standards.