Michael L Larson Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On February 13, 2026, the Akira ransomware group listed Michael L Larson on its leak site. The organization is described as Michael Larson & Co., P.C., which provides tax and client advisory services. The number of people affected is not known, and independent confirmation of any data exposure has not been reported. The listing indicates that internal files were taken during a ransomware attack. No further details on the date of the intrusion, the volume of material, or the precise method of access have been made public.

What happened

The incident centers on a ransomware operation that resulted in the exfiltration of internal files. The Akira group added the organization to its leak site on the reported date and stated an intention to release material. No additional technical details, confirmation of encryption, or ransom demands have been disclosed in available records.

The group behind it: akira

Akira is a ransomware operation that has conducted multiple campaigns against organizations in various sectors. Public reporting on the group describes a pattern of encrypting systems and exfiltrating data, followed by threats to publish the material if demands are not met. The group maintains a leak site where it lists claimed victims. In this case, the listing constitutes the group's own claim; no independent verification of the data's presence or contents has been established.

About Michael L Larson

Michael Larson & Co., P.C. operates as a professional services firm offering tax preparation and advisory work to clients across local, national, and international locations. Firms in this sector routinely collect and store financial records, client identification documents, and operational correspondence. Exposure of such material can affect both the organization’s clients and its internal operations because the data often includes details required for regulatory compliance and financial transactions.

The information in question

The available facts state only that internal files were exfiltrated. The group claims the material includes financial data such as audit records, payment details, financial reports, and invoices, along with employee and customer information that may contain passports, medical records, and driver’s licenses. The exact scope and authenticity of these claims remain unconfirmed.

Why it matters

Organizations that hold tax and advisory records maintain data that can be used for identity verification and financial activity. If the claimed material becomes public, affected individuals could face risks of account misuse or targeted fraud. For the firm, the incident may require notification to clients and regulatory bodies, along with review of its data-handling practices, even though the full impact is not yet known.

If your data was in this claimed breach

Individuals who have worked with the firm should treat any potential exposure as a reason to review their accounts and personal records. Concrete steps include:

• Monitor bank, credit, and tax accounts for unusual activity.
• Place fraud alerts or credit freezes with major bureaus if statements or identification documents may be involved.
• Run a free exposure scan of your email address against known breach datasets to check for additional appearances.

AICompiled with AI assistance from public sources and published under our editorial standards.