MerchNOW Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On March 31, 2026, the Akira ransomware group listed MerchNOW on its leak site and stated that corporate data would be uploaded. The company, a music merchandising firm, is reported to have suffered a ransomware attack in which internal files were allegedly exfiltrated. The number of individuals affected has not been disclosed. This listing occurs amid continued ransomware operations that combine encryption with data theft and public pressure on victims. Such incidents remain a persistent feature of the threat landscape for organizations that hold operational and personal records.

Breaking down the breach

Public reporting on the incident is limited to the March 31, 2026 listing. The scale of the operation, including the volume of data taken or any ransom demand, has not been confirmed. MerchNOW has not issued a public statement detailing the timeline or technical method of the intrusion.

The group behind it: akira

Akira is a ransomware operation that has conducted multiple campaigns since 2023, typically employing double-extortion tactics in which data are both encrypted and copied before a ransom is demanded. The group maintains a leak site where it lists victims and, in some cases, publishes samples of stolen material. In this instance the group claims responsibility for the MerchNOW incident and states that files will be released.

MerchNOW and its sector

MerchNOW provides merchandise production and fulfillment services to musicians and bands, including apparel, accessories, and custom items, along with services such as screen printing and record pressing. Companies in this sector routinely process orders, maintain supplier relationships, and store records related to clients, employees, and financial transactions.

What data was at risk

The exact contents of any exfiltrated material remain unconfirmed by independent sources. The Akira group claims to have obtained a range of internal documents. These claimed categories include:

• employee personal documents such as passports, driver’s licenses, Social Security numbers and other scanned identification
• financial records
• contracts and agreements
• client files, NDAs and project materials

Why it matters

Exposure of employee identity documents and financial information can enable identity theft or targeted fraud against individuals. For the organization, release of contracts, client files and internal agreements may affect commercial relationships and regulatory compliance obligations. Because the number of records involved is not yet known, the full scope of potential harm cannot be quantified at present.

What to do if you're exposed

Individuals who believe their information may have been involved should monitor their financial accounts and credit reports for unusual activity. They should also consider placing fraud alerts with major credit bureaus and changing passwords for any accounts that may reuse credentials. Readers can run a free exposure scan of their email to check whether their information has surfaced in known breach data. Organizations should follow established incident-response procedures and consult legal and cybersecurity advisors regarding notification requirements.

AICompiled with AI assistance from public sources and published under our editorial standards.