Milliman Financial Risk Management LLC (Milliman, Inc. subsidiary) Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
Milliman Financial Risk Management LLC, a subsidiary of Milliman, Inc., was listed by the Akira ransomware group on September 25, 2025, after internal files were exfiltrated in a ransomware attack. An undisclosed number of people may be affected; anyone who has done business with the firm should check for contact from Milliman or their own service providers and follow any instructions given.
On September 25, 2025, the ransomware group known as akira listed Milliman Financial Risk Management LLC on its leak site, claiming it had exfiltrated internal files in a ransomware attack. Public detail remains limited: the number of people affected is unknown, and independent confirmation of the intrusion or the full scope of any data removal has not been provided in the available record. For clients and others whose financial information may sit inside the systems of a firm that manages retirement savings risk, the listing raises immediate practical questions about whether portfolios, balances, transfers, contracts or related records could surface online.
The group has stated it intends to publish a large volume of corporate data. Until more is verified, those potentially connected to the firm have little choice but to treat the claim seriously and take basic protective steps while waiting for clearer official information.
What happened
According to the public listing dated September 25, 2025, akira claims to have conducted a ransomware attack against Milliman Financial Risk Management LLC, a subsidiary of Milliman, Inc. The group asserts that it exfiltrated internal files and plans to upload 260 GB of corporate data. No further technical details about the method of intrusion, the date the attack began, or any ransom demand appear in the available facts. The number of individuals whose information may be involved is listed as unknown. The listing itself constitutes an unverified claim by the group; it has not been independently confirmed in the material provided.
Inside akira
Akira is a ransomware operation that has been active in recent years and is known for double-extortion tactics. In typical cases the group encrypts systems and simultaneously steals data, then threatens to publish the stolen material on a dedicated leak site if payment is not made. Public reporting on prior incidents shows the group has targeted a range of sectors, including professional services and finance-related firms, often advertising large data volumes and client-related files to increase pressure. Listings on its site are claims made by the operators; they do not by themselves prove the accuracy of every detail asserted about a given victim. In this instance the group has specifically claimed it will release client financial portfolios, account balances, transfers, internal operating files, financial and accounting records, contracts, agreements and project materials belonging to Milliman Financial Risk Management LLC.
About Milliman Financial Risk Management LLC
Milliman Financial Risk Management LLC describes itself as a global leader in financial risk management services for the retirement savings industry. Established in 1998, the practice employs more than 200 professionals and operates trading platforms in Chicago, London and Sydney. It is a subsidiary of Milliman, Inc. Firms of this type typically hold detailed client investment data, risk models, account information, contractual documents and internal financial records in order to provide hedging, portfolio oversight and related services to retirement plans and institutional clients. A breach affecting such an organisation is consequential because the data it handles is both commercially sensitive and personally identifiable; exposure can affect plan sponsors, individual participants and the firm’s own operations and reputation.
The information in question
The available facts state that internal files were exfiltrated in a ransomware attack. The group claims the forthcoming 260 GB release will include client information such as financial portfolios, account balances and transfers, together with internal operating files, financial and accounting files, contracts, agreements and project materials. Exact data types beyond this claim have not been independently confirmed, and the total number of people affected remains unknown. Organisations that manage retirement-savings risk commonly store names, account identifiers, transaction histories, balance figures, contractual terms and internal correspondence; whether any specific subset of those categories was taken in this incident is unconfirmed.
What's at stake
If the claimed data is authentic and is published, individuals and plan sponsors could face risks of identity theft, targeted phishing, unauthorised account activity or competitive disadvantage. Account balances and transfer histories, if accurate, give criminals concrete information that can be used to craft convincing fraud attempts. Contracts and internal financial files could expose proprietary strategies or pricing. For the organisation itself, the incident may trigger regulatory scrutiny, client notification obligations, potential litigation and lasting damage to trust among the retirement-savings institutions it serves. Because the scale of any personal-data exposure is still unknown, the precise number of people who need to take action cannot yet be stated.
If your data was in this claimed breach
Public confirmation of individual exposure has not been released. Anyone who has a relationship with Milliman Financial Risk Management LLC or its parent should monitor official statements from the firm and from relevant regulators. In the meantime, practical first steps include:
- Review recent account statements and transaction alerts for any unrecognised activity.
- Enable multi-factor authentication on financial and email accounts where it is not already active.
- Place a fraud alert or credit freeze with the major credit bureaus if you believe sensitive identifiers may be involved.
- Treat unsolicited messages that reference the firm or your retirement accounts with heightened caution.
- Run a free exposure scan of your email address to check whether it has already appeared in other known breach data sets.
Continue to watch for updates from the company. Until more verified detail emerges, measured vigilance is the most useful response.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Southwood Financial,SWF FUNDING LLC, EduCap Inc. Listed by akira Ransomware GroupCohn Lifland Pearlman Herrmann and Knopf Listed by akira Ransomware GroupEdge Solutions | Stone Ridge Payments Listed by akira Ransomware GroupTrubee Wealth Advisors Listed by akira Ransomware GroupLatest breaches
Publicly posted by akira — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.