Berg Lilly Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware operations remain a persistent feature of the threat landscape in 2026, with groups routinely claiming to have compromised organizations that hold large volumes of client records. On June 18, 2026, the Akira ransomware group listed Berg Lilly, a law firm based in Bozeman, Montana, on its leak site. Public detail on the number of individuals affected, the precise volume of data taken, or the method of initial access remains undisclosed.

What happened

The incident involves the exfiltration of internal files during a ransomware attack on Berg Lilly. The Akira group listed the firm and stated it would upload approximately 50 GB of corporate data. No independent confirmation of the data volume or contents has been made public, and the firm has not released an official statement on the event.

Who is akira?

Akira is a ransomware group first observed in early 2023. It is known for double-extortion operations in which data is copied before encryption, followed by threats to publish the material if a ransom demand is not met. The group has targeted entities across multiple sectors and maintains a leak site to publicize claimed victims. Its listing of Berg Lilly constitutes an unverified claim by the group.

Berg Lilly and its sector

Berg Lilly is a law firm with more than 60 years of operation, providing legal services in areas that include business entity law, civil litigation, commercial transactions, construction law, employment law, estate planning, personal injury, and real estate law. Law firms routinely maintain extensive records on clients, opposing parties, and case matters, making them attractive targets for actors seeking sensitive information.

What was likely exposed

The only confirmed detail is that internal files were allegedly exfiltrated. The Akira group claims the material includes client personal information such as passports, Social Security numbers, driver’s licenses, addresses, phone numbers, confidential files, medical information, and financial records, along with court hearings and police reports. The exact contents and scope remain unconfirmed.

• Internal corporate files
• Client identification and contact data
• Medical and financial records
• Case-related documents including court and police materials

The real-world impact

Individuals whose information appears in legal files may face risks of identity misuse or unwanted disclosure of private matters. For the firm, the incident adds operational disruption and potential regulatory scrutiny common to any compromise of client data held by professional services organizations. The absence of Reported Details limits precise assessment of downstream effects.

If your data was in this claimed breach

Monitor accounts for unusual activity and consider placing fraud alerts with credit bureaus. Review any communications from Berg Lilly regarding the incident. Readers can run a free exposure scan of their email address against known breach data to check for prior appearances in public listings.

AICompiled with AI assistance from public sources and published under our editorial standards.