Dunlap Codding Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target professional-service firms that hold concentrated stores of sensitive client material, using double-extortion tactics that combine encryption with threats to publish stolen data. In this environment, law practices handling intellectual-property and litigation work have become frequent listings on criminal leak sites.

On 25 July 2025, the ransomware group known as akira publicly listed Dunlap Codding, an Oklahoma City law firm, claiming it had exfiltrated internal files. The number of people affected remains unknown, and independent confirmation of the intrusion has not been released. The listing itself is an unverified claim by the group.

Breaking down the breach

Public reporting on 25 July 2025 stated that Dunlap Codding had been listed by the akira ransomware group. According to the group’s own leak-site notice, it was prepared to upload more than 19 GB of corporate documents taken in a ransomware attack. The notice described the material as including client personal files, financial documents, project data, patent documents, court files, hearing notes and protocols. No further technical details—such as the initial access vector, the precise date of intrusion, or whether systems were encrypted—have been disclosed by the firm or by independent investigators. The scale of any confirmed impact and the exact volume of data that left the network therefore remain unconfirmed beyond the group’s claim.

Who is akira?

Akira is a ransomware operation that emerged in 2023 and has since maintained an active double-extortion model. The group typically gains access through compromised credentials or unpatched remote-access services, exfiltrates data, encrypts systems, and then posts victim names on a dedicated leak site while threatening to release the stolen files if a ransom is not paid. Its public listings have previously included manufacturing, professional-services and technology companies. Like other contemporary ransomware crews, akira operates as a brand under which affiliates may conduct attacks; the group’s statements about any single victim are therefore claims rather than independently Reported Facts. In the Dunlap Codding listing, akira asserted it held more than 19 GB of material and was ready to publish it; that assertion has not been corroborated by the firm or by outside forensic reports made public to date.

Who is Dunlap Codding?

Dunlap Codding is a law firm based in Oklahoma City that serves sophisticated international, national and regional clients. Firms of this type routinely manage intellectual-property portfolios, patent prosecution, litigation files, corporate transactions and confidential client correspondence. Because such practices act as trusted repositories for proprietary technical information, financial records and personal data belonging to clients, any unauthorized access carries consequences that extend beyond the firm itself to the businesses and individuals it represents. A breach at a patent-focused practice can therefore expose trade secrets, invention disclosures and related legal strategy documents that competitors or other adversaries might find valuable.

What data was at risk

The only description of the data comes from akira’s leak-site claim, which stated that internal files had been exfiltrated and that the haul included client personal files, financial documents, project data, patent documents, court files, hearing notes and protocols, totaling more than 19 GB. No official inventory from Dunlap Codding has been released, and the number of individuals whose information may be involved remains unknown. Law firms of this character typically hold attorney-client privileged material, invention records, financial statements, contact details and court filings; whether any of those categories were in fact taken, and in what volume, is unconfirmed outside the group’s assertion.

The real-world impact

If the claimed files are authentic and are released, clients could face exposure of personal identifiers, financial details or proprietary technical information that might be used for identity fraud, competitive intelligence or further social-engineering attacks. Patent documents and project data, once public, can undermine intellectual-property protections or reveal business strategy. For the firm itself, the incident raises the possibility of regulatory notification duties, client-notification costs, reputational harm and potential civil claims, though none of those outcomes have been publicly confirmed. Because the number of affected people is unknown, the breadth of any individual harm cannot yet be measured; the primary risk remains the unauthorized circulation of confidential legal and commercial records.

What to do if you're exposed

Anyone who has been a client of Dunlap Codding or has shared personal or corporate documents with the firm should monitor financial accounts and credit reports for unusual activity and consider placing a fraud alert with the major credit bureaus. Review any correspondence from the firm for official breach notifications that may contain specific guidance. Change passwords on accounts that may have been referenced in legal or financial files, and enable multi-factor authentication wherever available. Readers can also run a free exposure scan of their email address to check whether their information has already appeared in known breach data sets. If sensitive documents are later confirmed to have been published, consult legal counsel about protective measures appropriate to the material involved.

AICompiled with AI assistance from public sources and published under our editorial standards.