Friis & Moltke Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 22 December 2025 the Akira ransomware group listed the Danish architecture practice Friis & Moltke on its data-leak site. The listing states that internal files had been taken and that the group intended to publish approximately 12 GB of material. No confirmation of the volume, the date of the intrusion, or the number of individuals affected has been made public. The incident illustrates the continued focus of ransomware operators on professional-services firms that maintain records relating to clients, projects and regulatory compliance.

Inside the incident

Public information is confined to the leak-site posting. The group asserts that it obtained corporate data and will release files described as containing personal documents, financial records, project materials, specifications and drawings. No independent verification of the data set or its contents has been reported. The timing of the initial access, the method of intrusion and the precise scale of any exfiltration remain undisclosed.

Inside akira

Akira is a ransomware operation that first appeared in early 2023 and has since conducted campaigns against organisations in multiple countries and sectors. The group follows a double-extortion model in which data are copied before encryption and then used to pressure victims through public listings. Its leak sites have featured entities ranging from manufacturers to legal and design practices. Public reporting has documented the group’s use of common initial-access techniques such as compromised remote-access services and phishing, followed by lateral movement and selective data collection.

Friis & Moltke and its sector

Friis & Moltke is an architecture firm whose work spans commercial, public and residential projects for a range of clients. Practices of this type routinely store drawings, specifications, contractual correspondence, financial documentation and, in some cases, identification or compliance records belonging to employees, contractors or clients. When such material is placed at risk, the consequences extend beyond the organisation itself to individuals whose personal identifiers or project-related information may be involved.

What data was at risk

The listing claims that the exfiltrated material includes personal documents such as CPR numbers (Danish personal identification numbers), passports and other identity records, together with financial information, project files, specifications and drawings. The exact scope and sensitivity of any files that may ultimately be published have not been independently confirmed. Organisations in the architecture sector commonly hold client contact details, contract terms and technical documentation; whether additional categories of data were taken is not stated in available reporting.

Why it matters

Individuals whose identification numbers or passport details appear in any released material face the possibility of identity misuse or targeted fraud. Project-related files may contain commercially sensitive information that could affect contractual relationships or competitive positions. For the firm, the incident adds operational burden in the form of incident response, regulatory notification and potential reputational effects, even if the full extent of the data remains unverified.

What to do if you're exposed

Anyone concerned that their information may have been included should monitor bank and government-service accounts for unusual activity and consider placing fraud alerts where available. Changing passwords for any associated online services and enabling multi-factor authentication reduces further risk. Individuals can also run a free exposure scan of their email address against known breach data sets to determine whether their details have appeared in previously published collections.

AICompiled with AI assistance from public sources and published under our editorial standards.