Mantis Creative. Formerly known as WCI Rally. Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target professional services firms that hold concentrated collections of client and project data, using double-extortion tactics that pair encryption with public leak-site threats. Against that backdrop, the listing of Mantis Creative on 19 May 2025 by the group known as akira fits a familiar pattern of claims against creative and architectural-visualization agencies.

Public reporting states that Mantis Creative, formerly known as WCI Rally, was listed by the akira ransomware group after an alleged ransomware attack in which internal files were said to have been exfiltrated. The number of people affected remains unknown, and independent confirmation of the intrusion or the full contents of any stolen material has not been published. The listing itself is a claim by the group, not a verified disclosure by the company.

What happened

According to the available record, Mantis Creative appeared on the akira ransomware group’s leak site on 19 May 2025. The group asserted that it had conducted a ransomware attack and exfiltrated internal files. No technical details of the intrusion method, the date the systems were first compromised, or the precise scale of encryption have been disclosed in the public summary. The number of individuals whose information may have been involved is listed as unknown. The group further claimed it intended to upload more than 45 GB of corporate documents. Beyond that statement, timing, volume verification, and any ransom negotiation remain undisclosed.

Inside akira

Akira is a ransomware operation that has been publicly active since early 2023. Like many contemporary groups, it typically employs a double-extortion model: encrypting systems while also copying data and threatening to publish it on a dedicated leak site if payment is not made. The group has been observed targeting mid-sized organizations across multiple sectors, often gaining initial access through compromised credentials or unpatched remote services, then moving laterally to locate high-value file shares. Public reporting has linked akira to numerous listings of professional-services and manufacturing firms; the group’s leak-site posts routinely include sample file lists and volume claims. In this instance the listing of Mantis Creative is presented solely as the group’s claim; no independent forensic confirmation is contained in the available facts.

Who is Mantis Creative?

Mantis Creative describes itself as a leading architectural-visualization and creative agency in North America, specializing in visualization and creative solutions for real-estate projects and emerging brands. It was formerly known as WCI Rally. Firms of this type routinely handle design files, project documentation, client briefs, contracts, and related commercial material. Because such agencies sit at the intersection of creative production and real-estate development, a breach can expose both internal operational data and information belonging to clients whose projects are still confidential or commercially sensitive. The public summary notes that the company transforms ideas into high-performing brands, underscoring the concentration of intellectual and client-related assets that would typically be present on its systems.

The information in question

The facts state that internal files were exfiltrated in a ransomware attack. The akira group claims it will upload more than 45 GB of corporate documents such as contracts, client data, projects, and some financial data. Exact file inventories, the presence or absence of personal identifiers, and any confirmation that the full volume was in fact published remain unconfirmed. Organizations of this kind ordinarily store project files, contractual agreements, client contact and billing details, design assets, and limited financial records; whether those categories were among the material taken in this incident has not been independently verified.

Why it matters

For individuals and businesses whose information may have been among the claimed files, the principal risks are secondary use of contracts or project details for social-engineering attempts, exposure of commercially sensitive real-estate plans, and potential misuse of any financial or contact data that was present. For Mantis Creative the consequences include operational disruption, possible contractual obligations to notify clients, and reputational pressure arising from the public listing. Because the number of affected people is unknown and the precise contents unconfirmed, the full scope of harm cannot yet be quantified, yet the nature of the claimed material—contracts, client data, projects, and financial records—makes the incident consequential for both the firm and its clients.

If your data was in this claimed breach

If you have worked with Mantis Creative or its predecessor WCI Rally and believe your information could be involved, take the following practical steps:

• Monitor financial and email accounts for unexpected activity and enable multi-factor authentication where available.
• Treat unsolicited requests that reference specific projects or contracts with heightened caution, as social-engineering attempts often follow data theft.
• Request a copy of any personal data the company holds about you under applicable privacy law if you wish to confirm what was retained.
• Run a free exposure scan of your email address against known breach data sets to check whether your details have already appeared in other incidents.

Public detail remains limited; further verified information from the company or independent investigators would be required to refine these recommendations.

AICompiled with AI assistance from public sources and published under our editorial standards.