Bervar and Jones Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People who have used the services of a Hawaii law firm may now face the possibility that sensitive personal and legal records have been taken by criminals. When a ransomware group lists a professional practice on its leak site, the practical stakes are immediate: client files, identity documents, and confidential case materials can be exposed, sold, or used for further fraud long after the initial intrusion.

Public reporting dated April 07, 2025 states that Bervar and Jones has been listed by the akira ransomware group. The number of people affected remains unknown, and independent confirmation of the full scope is limited. What is known so far is that the group claims to have exfiltrated internal files in a ransomware attack and has described plans to publish a large volume of corporate and client material.

What happened

According to available reporting, Bervar and Jones was listed by the akira ransomware group on or around April 07, 2025. The incident is described as a ransomware attack in which internal files were allegedly exfiltrated. Public detail on the precise date of intrusion, the initial access method, and whether systems were encrypted remains undisclosed.

The group claims it will upload more than 102 GB of essential corporate documents. It further claims those materials include a substantial amount of client information such as medical records, drivers licenses, passports, birth and death certificates, court confidential files, financial data of clients, and NDAs. These statements originate from the threat actor’s own listing and have not been independently verified in the public record. The total number of individuals whose data may be involved is unknown.

Inside akira

Akira is a ransomware operation that has been active in public reporting since 2023. Like many contemporary ransomware groups, it typically follows a double-extortion model: operators encrypt systems and simultaneously steal data, then threaten to publish the stolen material on a dedicated leak site if a ransom is not paid. The group has been observed targeting organizations across multiple sectors and geographies, often using common initial-access techniques such as compromised credentials or exposed remote-access services, followed by lateral movement and data staging before encryption.

Akira’s leak site functions as both a pressure mechanism and a distribution channel. Listings frequently include claims about the volume of data taken and sample file names or descriptions intended to demonstrate authenticity. In this case, the listing of Bervar and Jones should be treated as an unverified claim by the group rather than confirmed proof of every asserted detail. No public confirmation of payment, decryption, or full data release has been included in the facts available for this incident.

Who is Bervar and Jones?

Bervar and Jones is a law firm associated with Ward D. Jones, who has practiced law in Hawaii for 30 years. Public description of the practice notes that he has handled trials in state courts on all of the islands, in Hawaii federal court, and in Hawaii arbitrations. Law firms of this type routinely manage highly sensitive client matters, including litigation files, personal identification documents, medical information relevant to cases, financial records, and confidential agreements.

A breach at a law firm is consequential because the data held is often both personally identifying and legally privileged. Clients entrust such firms with material that can affect court proceedings, personal safety, financial standing, and privacy. Even when the exact contents of a theft remain unconfirmed, the nature of the practice means any successful exfiltration carries elevated risk for the individuals whose matters were handled by the firm.

What data was at risk

The facts state that internal files were exfiltrated in a ransomware attack. Beyond that high-level description, the specific data types named publicly come from the akira group’s own claims. The group asserts that the material includes client information such as medical records, drivers licenses, passports, birth and death certificates, court confidential files, financial data of clients, and NDAs, totaling more than 102 GB of corporate documents.

These assertions have not been independently verified in the available reporting. Organizations of this kind typically hold client contact details, case files, identification documents, medical and financial records relevant to legal matters, and internal administrative data. Whether every category claimed by the group was actually taken, and the precise volume involved, remain unconfirmed. The number of people affected is unknown.

The real-world impact

For individuals whose information may have been among the taken files, the concrete risks include identity theft, financial fraud, and the misuse of personal documents such as drivers licenses or passports. Medical records and court-related materials can expose private health details or sensitive legal circumstances that were never intended for public view. Confidential agreements and financial data of clients can also be leveraged for targeted scams or further extortion attempts.

For the firm itself, the incident creates operational, reputational, and potential regulatory consequences. Clients may need to be notified, systems may require remediation, and the firm may face questions about how the intrusion occurred. Because the scale of affected individuals is unknown and the full contents of the exfiltration are unconfirmed, the precise breadth of harm cannot yet be measured. The primary concern remains the possible long-term exposure of personal and privileged information belonging to people who sought legal representation.

Were you affected?

If you have been a client of Bervar and Jones or have provided personal documents to the firm, treat the possibility of exposure seriously even while details remain limited. Monitor financial accounts and credit reports for unusual activity, be alert to phishing or social-engineering attempts that reference legal or medical matters, and consider placing fraud alerts with major credit bureaus if you believe sensitive identity documents may have been involved. Change passwords on any accounts that reused credentials potentially stored in firm systems, and enable multi-factor authentication wherever available.

Readers can also run a free exposure scan of their email address to check whether their information has already surfaced in known breach data sets. Because the number of people affected and the exact data released remain unconfirmed, proactive monitoring is a practical first step while further official details, if any, emerge.

AICompiled with AI assistance from public sources and published under our editorial standards.