CreateASoft Listed by Akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On September 8, 2026, the ransomware group known as Akira listed CreateASoft on its leak site. That listing is an accusation from an extortion crew, not a finding confirmed by the company, a regulator, or an independent breach index. As of writing, CreateASoft has not publicly confirmed the claim.

Public detail is limited. The number of people who might be affected is unknown, and the listing does not provide a verified inventory of what, if anything, was taken. What matters for readers is understanding what such a claim does and does not establish, and what practical steps make sense if their information were later shown to be involved.

What is being claimed

Akira has listed CreateASoft on its leak site and, according to the listing text associated with the report, indicated that it would upload corporate data and referred in general terms to employee and customer files, contacts and agreements, financials, projects, and similar material. Those words are the group’s own description on a leak site. They are marketing for an extortion narrative, not a confirmed catalogue of stolen records.

The report does not disclose how the group says it obtained access, whether any ransom demand was made, how large any alleged dataset is, or whether any files have actually been published. Timing beyond the September 8, 2026 listing date is not detailed in the available facts. CreateASoft is described in the same material as a software company focused on dynamic process improvement, predictive technology, and end-to-end support for process-based operations. None of that background converts the leak-site entry into verified proof of a breach.

In short: a named group has claimed CreateASoft as a victim and has previewed categories of corporate material it says it will release. The company has not publicly confirmed the claim, and independent confirmation is not part of the facts provided here.

Inside Akira

Akira is a ransomware and data-extortion operation that has been widely tracked in public reporting since around 2023. Like many groups in this category, it has typically been associated with encrypting systems in some incidents and with threatening to publish stolen data to pressure payment, often using a dedicated leak site to name alleged victims and post samples or full dumps when talks fail or deadlines pass.

Public analyses of Akira have often described double-extortion patterns: disruption inside the victim environment paired with the threat of exposure. The group has been linked in industry reporting to a range of sectors and geographies, with listings that sometimes appear before any corporate statement. Tactics attributed to the broader ransomware ecosystem—initial access through common weak points, lateral movement, and data staging before encryption or leak threats—are frequently discussed in defensive literature; those are general patterns, not proven steps in this specific case.

For this article, the only claim tied to CreateASoft is the leak-site listing and the accompanying language about intended uploads. No further statements from Akira about this organisation are established in the facts, and nothing here should be read as confirmation that the group’s allegations are accurate.

CreateASoft and its sector

CreateASoft is presented as a software firm that supplies process-improvement and predictive tools and related support to organisations that run process-heavy operations. Companies in that niche typically sit close to how clients plan work, measure performance, and coordinate people and systems. Their own environments often hold commercial contracts, project records, internal finance material, and directories of employees and customers—not because every firm is identical, but because that is the ordinary shape of a B2B software and services business.

A leak-site listing against a vendor in this space draws attention because client organisations may worry about shared credentials, support channels, or documents exchanged during implementations. That concern is about potential knock-on risk if a claim were later substantiated; it is not evidence that any particular client file left CreateASoft’s control. The listing alone does not establish negligence, poor engineering, or failed detection at the named company, and this article does not draw those conclusions. What it establishes is that an extortion group has chosen to name the firm in public.

What data was at risk

The facts state that specific data types exposed are not disclosed in a verified sense. The attacker-controlled listing language mentions employee and customer files, contacts and agreements, financials, projects, and similar corporate material, and says data would be uploaded “soon.” That is the group’s claim, not an audited inventory.

If files of the kind software and professional-services firms commonly hold were involved in any real incident, organisations in this sector typically retain business contact details, contracts and statements of work, project documentation, internal financial records, and employee-related administrative data. Customer environments can also appear in support tickets or shared design materials. None of those categories should be treated as reportedly stolen from CreateASoft. Exact contents, volume, and sensitivity remain unconfirmed, and the number of people affected is unknown.

What's at stake

For individuals, the conditional risk—if personal or work contact data, identity documents, or employment details were ever published—includes phishing that references real projects or colleagues, credential stuffing against reused passwords, and social engineering aimed at finance or IT staff. For client companies, the conditional risk includes exposure of commercial terms, operational plans, or technical notes that competitors or fraudsters could misuse.

For the organisation named on the leak site, the stakes include reputational pressure, customer questions, and the operational cost of investigating an unverified claim. Extortion listings are designed to create urgency whether or not a full dump ever appears. Readers should separate that pressure from proven fact: a listing is a claim; confirmation would require the company, a regulator, or other credible independent reporting, which the facts here do not include.

If your data was involved

If you have a past or present relationship with CreateASoft as an employee, customer, or partner, treat the situation as conditional. Watch for unexpected password resets, invoices, or messages that cite internal project names. Prefer official channels you already trust rather than links in unsolicited email. Enable multi-factor authentication where you can, and avoid reusing passwords across work and personal accounts. If you later see concrete evidence that your information appeared in a dump, consider credit or fraud alerts appropriate to your country, and report clear identity theft to the relevant authorities.

You can also run a free exposure scan of your email address to check whether that address has already appeared in known breach datasets unrelated to this claim. That kind of check does not prove or disprove Akira’s listing about CreateASoft; it only helps you see whether your email is already circulating in broader breach material and whether tighter account hygiene is overdue.

AICompiled with AI assistance from public sources and published under our editorial standards.