Bergeson Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target professional-services firms that hold concentrated volumes of sensitive client and corporate records, using double-extortion tactics that combine encryption with public leak threats. Against that backdrop, Bergeson, LLP, a Silicon Valley litigation practice, appeared on the Akira ransomware group’s leak site on 10 November 2025. Public detail remains limited: the number of people affected is unknown, and independent confirmation of the claimed data volume or contents has not been released. The listing itself is an unverified claim by the group, yet it underscores the ongoing risk that law-firm data can pose when internal files are taken.

What is known so far is that Akira asserts it has exfiltrated internal files in a ransomware attack and is prepared to publish more than 33 GB of material. The firm has not publicly detailed the intrusion method, timeline, or containment steps, leaving affected individuals and clients with incomplete information about exposure.

Inside the incident

According to the publicly reported listing dated 10 November 2025, Bergeson was named by the Akira ransomware group. The group states that internal files were exfiltrated during a ransomware attack and that it is ready to upload more than 33 GB of data. No independent verification of the intrusion vector, the exact date of compromise, or the full scope of systems affected has been made available. The number of people whose information may be involved remains unknown. The only concrete assertion on record is the group’s own claim that the stolen material includes essential corporate documents. Beyond that listing, further technical or forensic particulars have not been disclosed.

The group behind it: akira

Akira is a ransomware operation that became active in 2023 and has since conducted double-extortion campaigns against organisations across multiple sectors. The group typically gains initial access through compromised credentials or unpatched remote-access services, deploys ransomware that encrypts systems, and simultaneously exfiltrates data to pressure victims into paying. It maintains a dedicated leak site where it posts victim names and sample files, then threatens full publication if ransom demands are unmet. Prior public activity has included attacks on manufacturing, education, and professional-services entities in North America and Europe. In this instance the group claims Bergeson as a victim and asserts possession of more than 33 GB of internal files; those statements remain claims pending independent confirmation.

Who is Bergeson?

Bergeson, LLP is a litigation law firm based in Silicon Valley and established in 1990. It specialises in representing individuals and companies in high-profile and high-stakes litigation across the United States, focusing on complex business disputes. Like most litigation practices of this type, the firm routinely handles confidential client communications, case strategy documents, financial records related to disputes, and personal identifying information of employees, clients, and opposing parties. A breach at such an organisation is consequential because the data it holds is often uniquely sensitive—legal strategy, settlement figures, and personal identifiers that cannot easily be changed—and because clients entrust the firm with information they expect to remain privileged and secure.

What data was at risk

The only data types named in connection with the incident are “internal files exfiltrated in a ransomware attack.” The Akira group further claims that the material includes financial data (audits, payment details, invoices), detailed employee and customer information (passports, driver’s licences, Social Security numbers, death and birth certificates), and other confidential information, amounting to more than 33 GB. These specifics originate solely from the group’s leak-site statement and have not been independently verified. Exact contents therefore remain unconfirmed. Organisations of this kind typically retain client matter files, billing records, personnel documents, and identity documents required for litigation or employment; whether any of those categories were in fact taken cannot be stated as fact on the present record.

What's at stake

For individuals whose information may have been included, the concrete risks include identity theft, fraudulent account openings, and targeted social-engineering attempts that exploit knowledge of personal identifiers or legal matters. Clients could face exposure of sensitive business or personal disputes, potentially affecting ongoing litigation or commercial negotiations. For the firm itself, the stakes include reputational harm, possible regulatory scrutiny under data-protection rules, and the operational cost of investigation, notification, and remediation. Because the number of affected people is unknown and the precise data set is unconfirmed, the full extent of these risks cannot yet be quantified, but the combination of financial and identity documents claimed by the group would, if accurate, create lasting exposure for those named in the files.

What to do if you're exposed

If you have a past or present relationship with Bergeson—as a client, employee, or opposing party—monitor financial accounts and credit reports for unexpected activity and consider placing a fraud alert with the major credit bureaus. Change passwords on any accounts that may have shared credentials with the firm, and enable multi-factor authentication where available. Retain copies of any breach notifications you receive and follow the specific guidance they contain. Readers can also run a free exposure scan of their email address to check whether their information has already surfaced in known breach data sets; doing so provides an early indication of whether further protective steps are warranted.

AICompiled with AI assistance from public sources and published under our editorial standards.