Cook Brown Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Cook Brown LLP, a law firm specializing in labor and employment matters, was listed by the akira ransomware group on September 16, 2025. Public reporting indicates that internal files were exfiltrated during a ransomware attack, though the number of people affected remains unknown and many operational details have not been confirmed.

The listing itself constitutes a claim by the group rather than independent verification. For clients, employees, and others who may have shared sensitive information with the firm, the incident raises clear questions about what material may have left the network and what practical steps follow.

Breaking down the breach

According to available public information, Cook Brown was listed by the akira ransomware group on September 16, 2025. The reported summary states that internal files were exfiltrated in a ransomware attack. The group claims it will upload 160 GB of corporate data and asserts that the material includes client data containing at least 100 Social Security numbers and other personal information, employee files such as passports and other personal documents, police reports, court documents, medical information, HR data, contracts and agreements, payment details and other financial information, and NDAs.

No independent confirmation of the volume, the precise contents, or the success of any encryption or exfiltration has been published in the provided record. Timing of the intrusion, the initial access method, and whether ransom negotiations occurred are undisclosed. The number of individuals potentially affected is listed as unknown.

The group behind it: akira

Akira is a ransomware operation that has been active in public reporting since 2023. The group typically employs a double-extortion model: encrypting systems while also claiming to steal data and threatening to publish it on a dedicated leak site if payment is not made. Public analyses of prior campaigns describe the use of common initial-access techniques such as compromised credentials or vulnerable remote-access services, followed by lateral movement and data staging before encryption.

Akira has previously listed organizations across multiple sectors, including professional services. Its leak-site postings are claims made by the group; they do not by themselves constitute verified proof that the described data was obtained or will be released. In this case, the listing of Cook Brown and the accompanying description of 160 GB of material and specific data categories are presented solely as the group’s assertions.

Cook Brown and its sector

Cook Brown LLP is a firm that specializes in labor and employment law. It provides legal representation to employers in areas that include litigation, claims settlement, and labor relations. Law firms of this type routinely handle confidential client communications, personnel records, litigation files, settlement documents, and related financial or contractual materials.

Because the firm’s work centers on employment disputes and employer defense, the data it holds often includes sensitive personal identifiers, medical or disability-related information, and documents that could affect ongoing legal proceedings or workplace relationships. A breach involving such material is consequential both for the firm’s clients and for any individuals whose records appear in those files.

What data was at risk

The facts identify the exposed material as internal files exfiltrated in a ransomware attack. The akira group claims the data set totals 160 GB and contains client data with at least 100 Social Security numbers and other personal information, employee files including passports and other personal documents, police reports, court documents, medical information, HR data, contracts and agreements, payment details and other financial information, and NDAs.

These specific categories and the 160 GB figure are claims made by the group and remain unconfirmed by independent sources in the available record. Organizations in the labor-and-employment legal sector typically retain precisely the kinds of records the group describes—client matter files, employee personnel documents, litigation materials, and financial records—but the exact contents of any exfiltrated archive in this incident have not been verified publicly.

Why it matters

If the claimed material was in fact taken, individuals whose Social Security numbers, passport images, medical details, or financial information appear in the files face elevated risks of identity theft, targeted fraud, or unauthorized use of personal documents. Clients involved in labor disputes could see confidential strategy, settlement terms, or witness information exposed, potentially affecting ongoing cases or future negotiations.

For the firm itself, the incident creates operational, reputational, and regulatory exposure. Law firms are expected to safeguard privileged and confidential client data; any confirmed loss can trigger notification obligations, client inquiries, and possible professional-liability considerations. Because the number of affected people is unknown and the precise data set unconfirmed, the full scope of downstream harm cannot yet be measured, but the categories claimed by the group are among the most sensitive routinely held by employment counsel.

Were you affected?

Anyone who has been a client, employee, or opposing party in matters handled by Cook Brown should monitor financial accounts, credit reports, and official identity documents for unusual activity. Consider placing fraud alerts or credit freezes with the major credit bureaus and reviewing any recent correspondence from the firm for official breach notifications. If you receive unsolicited requests for personal information that reference the firm or related legal matters, treat them with caution and verify through known contact channels.

Readers can also run a free exposure scan of their email address to check whether their information has already appeared in known breach data sets. Such checks provide an additional early-warning signal while official notifications, if any, are still pending.

AICompiled with AI assistance from public sources and published under our editorial standards.