Jones Soda (Stock Symbol: JSDA) Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target mid-sized manufacturers and consumer brands, often combining data theft with public leak-site postings to pressure victims. In this environment, even companies outside the technology sector can find themselves listed as targets, with claims of stolen corporate files circulating before independent confirmation is available.

On August 15, 2025, Jones Soda Co. appeared on a listing associated with the akira ransomware group. The group claims to have exfiltrated internal files in a ransomware attack and stated its intention to publish 66 GB of corporate data. The number of people affected remains unknown, and public detail on the incident is limited to the group's assertions and the fact of the listing itself. For employees, partners, and customers of a publicly traded craft-beverage company, such claims raise practical questions about what information may have left the organisation and what steps are available while verification continues.

What happened

According to the available record, Jones Soda Co. (stock symbols CSE: JSDA and OTCQB: JSDA) was listed by the akira ransomware group on August 15, 2025. The listing characterises the event as a ransomware attack in which internal files were allegedly exfiltrated. The group further claims it is preparing to upload 66 GB of corporate data. No independent confirmation of the intrusion method, the precise date of any compromise, or the total volume of data taken has been supplied in the public facts. The number of individuals affected is listed as unknown. Beyond the group's own statements, details of timing, scale, and technical method remain undisclosed.

Who is akira?

Akira is a ransomware operation that has been active in recent years, typically employing a double-extortion model: encrypting systems while also stealing data and threatening to publish it on a dedicated leak site if payment is not made. Public reporting on the group describes the use of common initial-access techniques, followed by data staging and exfiltration before encryption. Victims across manufacturing, professional services, and other sectors have appeared on its listings. In the present case the group claims to hold Jones Soda Co. data and to be preparing a 66 GB release; those assertions remain unverified claims rather than independently What's Publicly Reported. No additional statements attributed specifically to this victim beyond the listing language are part of the public record provided.

Who is Jones Soda Co.?

Jones Soda Co. is a publicly traded craft-soda manufacturer that also maintains a growing line of cannabis products. Companies of this type typically manage employee records, financial systems, supplier and distributor contracts, payment-processing information, and various commercial agreements. Because the firm is listed on Canadian and U.S. over-the-counter markets, it is subject to ordinary disclosure and governance expectations. A ransomware listing that claims theft of internal files is consequential for any organisation that holds personal data of staff, payment details, and contractual materials with major partners; the potential exposure of such material can affect both day-to-day operations and the trust of employees and counterparties.

What was likely exposed

The facts identify the exposed material only as “internal files exfiltrated in ransomware attack.” The akira listing itself claims the data set includes employee information (complete names, dates of birth, addresses, emails, phone numbers, Social Security numbers and similar identifiers), financials, payment details, credit-card details, numerous contracts and agreements (including with PepsiCo and others), and NDAs. These descriptions originate solely from the group’s claim and have not been independently verified in the available record. Organisations in the beverage and consumer-products sector commonly retain precisely these categories of records—personnel files, banking and payment data, and commercial contracts—so the claimed contents align with what such a company would typically hold. Exact contents and the true volume of any theft remain unconfirmed.

Why it matters

If the claimed data were in fact taken, employees could face risks of identity theft, targeted phishing, or fraudulent account openings based on names, dates of birth, addresses, and Social Security numbers. Payment and credit-card details, if present, create direct financial-fraud exposure. Contracts and NDAs, once public, can reveal commercial terms, pricing, or partner relationships that competitors or other parties might exploit. For the company itself, the incident may disrupt operations, require forensic and legal response costs, and affect relationships with distributors and investors. Because the number of people affected is unknown and the data types rest on an unverified claim, the precise scale of harm cannot yet be measured; the practical risk, however, is that personal and financial information of staff and counterparties could circulate beyond the organisation’s control.

What to do if you're exposed

Individuals who have worked for or done business with Jones Soda Co. should monitor bank and credit-card statements for unfamiliar activity and consider placing a fraud alert or credit freeze with the major credit bureaus. Review any recent emails or messages that request personal or financial information, as stolen contact data is frequently used for phishing. Change passwords on accounts that may have shared credentials with work systems, and enable multi-factor authentication where available. Keep records of any suspicious contacts. Readers can also run a free exposure scan of their email address to check whether their information has already surfaced in known breach data sets; such a scan provides an early indication of whether further monitoring is warranted while official confirmation of this incident remains limited.

AICompiled with AI assistance from public sources and published under our editorial standards.