DigiCOURSE Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On January 16, 2026, the Akira ransomware group listed DigiCOURSE on its leak site and stated that it had exfiltrated internal files from the company. The number of individuals affected remains unknown, and no independent confirmation of the data volume or contents has been made public. The incident reflects the continued activity of ransomware operators that combine encryption with data theft to pressure targeted organizations.

Breaking down the breach

The only confirmed public detail is the listing itself. Akira posted a notice claiming possession of corporate data and indicated that files would be uploaded. No specific date of intrusion, attack method, or ransom demand has been disclosed. The scale of any encryption or exfiltration is also unreported. Public statements from DigiCOURSE confirming or disputing the claims have not appeared in available records.

Who is akira?

Akira is a ransomware operation that emerged publicly in early 2023 and has since conducted campaigns against organizations in multiple countries. The group typically uses double-extortion tactics: it encrypts systems and also removes copies of data, then threatens to publish the material unless payment is made. Its leak sites have hosted claims against entities in manufacturing, logistics, and professional services. Public reporting has linked Akira infrastructure to earlier variants associated with the Conti group, though the operators maintain separate branding and infrastructure.

About DigiCOURSE

DigiCOURSE provides command-and-control positioning systems used in offshore marine oil and gas exploration. Its services include engineering, customized manufacturing, and non-magnetic calibration. Companies in this sector routinely handle technical specifications, client contracts, personnel records, and financial documentation tied to high-value industrial projects. A compromise at such a firm can therefore touch both operational technology environments and conventional business records.

What was likely exposed

The listing states that internal files were taken. The group claims these include employee personal information such as passports and identification documents, client information, detailed financial records, and nondisclosure agreements. No independent verification of these categories has been published, and the company has not released an inventory of affected data. Until confirmed, the precise contents remain unconfirmed.

• Employee identity documents referenced in the claim
• Client records and contracts referenced in the claim
• Financial documentation referenced in the claim
• Nondisclosure agreements referenced in the claim

Why it matters

Individuals whose passports, identification numbers, or employment records appear in the claimed material face risks of identity misuse and targeted fraud. Clients whose project details or contractual terms are involved may encounter competitive or regulatory exposure. For the organization, the incident adds operational disruption, potential regulatory scrutiny in jurisdictions that require breach notification, and the cost of investigation and remediation. Industrial suppliers of this type often support critical infrastructure projects, so secondary effects on project timelines are also possible even if no direct operational-technology compromise is confirmed.

Were you affected?

Begin by monitoring official statements from DigiCOURSE for any notification process. Individuals can request a copy of their personal data held by the company under applicable privacy regulations. Review financial accounts and credit files for unusual activity. A free exposure scan of an email address against known breach datasets can indicate whether the address has appeared in previously published collections, though it cannot confirm presence in this specific incident.

AICompiled with AI assistance from public sources and published under our editorial standards.